This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3_0_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git

commit e72b7f319f1b0bc6274b07c5e5d286a600289748
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Sep 18 17:17:14 2026 +0100

    Javadoc updates
---
 .../apache/wss4j/common/ConfigurationConstants.java    | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git 
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
 
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
index 9461fcb2c..cbff5719e 100644
--- 
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
+++ 
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
@@ -956,21 +956,27 @@ public class ConfigurationConstants {
     public static final String VALIDATOR_MAP = "validatorMap";
 
     /**
-     * This holds a reference to a ReplayCache instance used to cache 
UsernameToken nonces. The
-     * default instance that is used is the EHCacheReplayCache.
+     * This holds a reference to a ReplayCache instance used to cache 
UsernameToken nonces.
+     * WSS4J core does not create a default ReplayCache: integrations such as 
Apache CXF configure
+     * an EHCacheReplayCache for inbound recipient messages, and applications 
using WSS4J directly
+     * must configure one themselves for replay detection to take place at all.
      */
     public static final String NONCE_CACHE_INSTANCE = "nonceCacheInstance";
 
     /**
-     * This holds a reference to a ReplayCache instance used to cache 
Timestamp Created Strings. The
-     * default instance that is used is the EHCacheReplayCache.
+     * This holds a reference to a ReplayCache instance used to cache 
Timestamp Created Strings.
+     * WSS4J core does not create a default ReplayCache: integrations such as 
Apache CXF configure
+     * an EHCacheReplayCache for inbound recipient messages, and applications 
using WSS4J directly
+     * must configure one themselves for replay detection to take place at all.
      */
     public static final String TIMESTAMP_CACHE_INSTANCE = 
"timestampCacheInstance";
 
     /**
      * This holds a reference to a ReplayCache instance used to cache SAML2 
Token Identifier
-     * Strings (if the token contains a OneTimeUse Condition). The default 
instance that is
-     * used is the EHCacheReplayCache.
+     * Strings (if the token contains a OneTimeUse Condition). WSS4J core does 
not create a default
+     * ReplayCache: integrations such as Apache CXF configure an 
EHCacheReplayCache for inbound
+     * recipient messages, and applications using WSS4J directly must 
configure one themselves for
+     * replay detection to take place at all.
      */
     public static final String SAML_ONE_TIME_USE_CACHE_INSTANCE = 
"samlOneTimeUseCacheInstance";
 

Reply via email to