title: How to prevent CXF secured webservices access from browser
body: <p>I am developing a basic WebService example using CXF and Spring.
  Here are my classes:</p>
  
  <pre><code>public interface AuthService {
   @WebMethod
     Person getPerson(@WebParam(name="user_id") Long userId);
  }
  </code></pre>
  
  <p>The WS implementation is as follow:</p>
  
  <pre><code>public class AuthServiceImpl implements AuthService{
  
  public Person getPerson(Long gid) {
      Person p = new Person();
      p.setUserId(gid);
      p.setEmail("test"+gid+"@test.de");
      p.setName("test"+gid);
  
      return p;
  }
  
  }
  </code></pre>
  
  <p>My web.xml is as follow:</p>
  
  <pre><code>&lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt; 
  &lt;context-param&gt;
     &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
    &lt;param-value&gt;WEB-INF/cxf-beans.xml&lt;/param-value&gt;
  &lt;/context-param&gt;    
  &lt;servlet&gt;
      &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;
          org.apache.cxf.transport.servlet.CXFServlet
      &lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>My cxf-beans.xml is:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  &lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
  &lt;import resource="classpath:META-INF/cxf/cxf-extension-soap.xml"/&gt;
  
  
  &lt;bean id="logInBound" class="org.apache.cxf.interceptor.LoggingInInterceptor" /&gt;
  &lt;bean id="logOutBound" class="org.apache.cxf.interceptor.LoggingOutInterceptor" /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>Here is my cxf-servlet.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:jaxws="http://cxf.apache.org/jaxws"
    xmlns:soap="http://cxf.apache.org/bindings/soap"
    xsi:schemaLocation="
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
  http://cxf.apache.org/bindings/soap http://cxf.apache.org/schemas/configuration/soap.xsd
  http://cxf.apache.org/jaxws
  http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  &lt;jaxws:server id="jaxwsService" serviceClass="com.iptech.cxfws.service.AuthService" address="/auth_user"&gt;
  &lt;jaxws:serviceBean&gt;
      &lt;bean class="com.iptech.cxfws.service.impl.AuthServiceImpl" /&gt;
  &lt;/jaxws:serviceBean&gt;
  
  
  &lt;jaxws:inInterceptors&gt;
    &lt;ref bean="interceptor"/&gt;
  &lt;/jaxws:inInterceptors&gt;
  &lt;/jaxws:server&gt;
  
  &lt;bean id="interceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
   &lt;constructor-arg&gt;
     &lt;map&gt;
       &lt;entry key="action" value="UsernameToken" /&gt;
       &lt;entry key="passwordType" value="PasswordText" /&gt;
       &lt;entry key="passwordCallbackRef"&gt;
              &lt;ref bean="passwordCallback" /&gt;
       &lt;/entry&gt;
     &lt;/map&gt;
   &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  &lt;bean id="passwordCallback" class="com.iptech.cxfws.service.callback.ServerPasswordCallback"/&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>And finally is my ServerPasswordCallback class:</p>
  
  <pre><code>public class ServerPasswordCallback implements CallbackHandler {
  
  public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
  
      WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
      String username = pc.getIdentifier();
      String password = //get it from a business class
      pc.setPassword(password);
  }
  </code></pre>
  
  <p>}</p>
  
  <p>As you can see this is a very simple example you can find in every CXF basic tutorial.
  Now, I have two problems:
  1) When I call </p>
  
  <pre><code>http://localhost:8080/cxf-ws/auth_user/getPerson?user_id=11 
  </code></pre>
  
  <p>from Internet browser (Chrome) I get a response, no username/password verification is done. However, when invoking the WS from a Java client, I can't get the response without including username/password in the SOAP message header. Is this normal ?
  2) The second question has nothing to do with WS-Security. When deploying/publishing my WS to Tomcat, everything works as expected (except the security issue mentioned above). But, I have the following exception: </p>
  
  <pre><code>    javax.xml.bind.UnmarshalException: unexpected element 
  (URI : "http://schemas.xmlsoap.org/ws/2005/04/discovery", local : "Probe"). 
  Expected elements are &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}AppSequence&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Bye&gt;,
  &lt;{http://www.w3.org/2005/08/addressing}EndpointReference&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Hello&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}MetadataVersion&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Probe&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}ProbeMatches&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Resolve&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}ResolveMatches&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Scopes&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Security&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Sig&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}SupportedMatchingRules&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}Types&gt;,
  &lt;{http://docs.oasis-open.org/ws-dd/ns/discovery/2009/01}XAddrs&gt;
  </code></pre>
  
  <p>Any help is very appreciated.</p>