如何在JAX-WS生成的SOAP WebService客户端中正确添加HTTP Header

我可以通过SoapUI正常访问该Web服务，但在Spring项目中调用JAX-WS生成的客户端时持续收到403响应。

SoapUI中的请求详情 #

POST https://WEB_SERVICE_URL HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
AUTH_HEADER: AUTH_HEADER_VALUE
Content-Length: 224
Host: WEB_SERVICE_HOST
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.5 (Java/16.0.2)

SoapUI原始响应 #

HTTP/1.1 200 OK
Content-Type: text/xml;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
server: Apache-Coyote/1.1
access-control-allow-origin: https://pje.trt13.jus.br
access-control-allow-headers: Authorization, Content-Type, x-xsrf-token
access-control-allow-credentials: true
set-cookie: JSESSIONID=08a467eac8b5a940~3Gv3nJT+VOBPIT-lNSphT3lO; Path=/primeirograu; Secure
date: Thu, 12 Dec 2024 19:22:03 GMT
strict-transport-security: max-age=15768000; includeSubDomains; preload
cache-control: public, no-transform
content-security-policy: frame-ancestors 'self' jte.csjt.jus.br jte.trt5.jus.br *.jte.trt5.jus.br
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
feature-policy: camera 'none'; microphone 'none'
access-control-expose-headers: Date
vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 f9bea17c7a13cd7f1b28e1a7cb598810.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FOR50-P3
X-Amz-Cf-Id: bXKBzXIxFnWPmG2Fa3U5GMQ9TquiYguIJyGRCBzTiMt0Sih2pl6TvQ==

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <ns2:consultarJurisdicoesResponse xmlns:ns2="http://ws.pje.cnj.jus.br/">
            <return><descricao>Santa Rita</descricao><id>41</id></return>
            <return><descricao>Itaporanga</descricao><id>46</id></return>
            <return><descricao>Guarabira</descricao><id>48</id></return>
            <return><descricao>Catolé do Rocha</descricao><id>49</id></return>
            <return><descricao>Patos</descricao><id>50</id></return>
            <return><descricao>Sousa</descricao><id>51</id></return>
            <return><descricao>Campina Grande</descricao><id>55</id></return>
            <return><descricao>João Pessoa</descricao><id>44</id></return>
        </ns2:consultarJurisdicoesResponse>
    </soap:Body>
</soap:Envelope>

我的客户端代码 #

客户端工厂类 #

@Component
public class TRT13Client {

    private ConsultaPJeService222 consultaPJeTrtService = new ConsultaPJeService222();

    public ConsultaPJe222 getConsultaPJeTrtService() {
        ConsultaPJe222 consultaPJeTRT = consultaPJeTrtService.getConsultaPJePort();

        Map<String, List<String>> requestHeaders = new HashMap<>();
        requestHeaders.put(AUTH_HEADER, List.of(AUTH_HEADER_VALUE));

        BindingProvider bindingProvider = (BindingProvider) consultaPJeTRT;
        bindingProvider.getRequestContext().put(MessageContext.HTTP_REQUEST_HEADERS, requestHeaders);

        return consultaPJeTRT;
    }
}

Controller类 #

@RestController
@RequestMapping("trt13/jurisdicao")
@RequiredArgsConstructor
public class JurisdicaoTRT13Controller {

    private final TRT13Client trt13Client;

    @GetMapping
    public ResponseEntity<List<Jurisdicao>> buscarJurisdicoes() {
        return ResponseEntity.ok(trt13Client.getConsultaPJeTrtService().consultarJurisdicoes());
    }
}

我尝试过通过设置MessageContext.HTTP_REQUEST_HEADERS添加自定义Header，但没有效果，所有客户端类都是通过JAX-WS的wsimport生成的，请问问题出在哪里？

针对你的问题，可能的原因和修复方式如下：

1. 检查Header名称是否匹配 #

从SoapUI响应的access-control-allow-headers字段可以看到，服务端允许的Header列表是Authorization, Content-Type, x-xsrf-token。确认你使用的AUTH_HEADER名称是否和服务端要求完全一致——Header名称大小写敏感，若实际应为Authorization而非自定义名称，会直接导致鉴权失败返回403。

2. 避免覆盖默认HTTP Headers #

你当前的代码直接替换了整个HTTP_REQUEST_HEADERS Map，会丢失JAX-WS自动生成的默认Header（如Content-Type、SOAPAction），这些是服务端正常处理请求的必需项。正确做法是先获取已有Header再添加自定义项：

public ConsultaPJe222 getConsultaPJeTrtService() {
    ConsultaPJe222 consultaPJeTRT = consultaPJeTrtService.getConsultaPJePort();
    BindingProvider bindingProvider = (BindingProvider) consultaPJeTRT;
    
    // 获取已有请求Header，避免覆盖默认值
    Map<String, List<String>> requestHeaders = (Map<String, List<String>>) 
        bindingProvider.getRequestContext().get(MessageContext.HTTP_REQUEST_HEADERS);
    
    if (requestHeaders == null) {
        requestHeaders = new HashMap<>();
    }
    // 添加自定义Header
    requestHeaders.put(AUTH_HEADER, List.of(AUTH_HEADER_VALUE));
    // 设置回请求上下文
    bindingProvider.getRequestContext().put(MessageContext.HTTP_REQUEST_HEADERS, requestHeaders);

    return consultaPJeTRT;
}

3. 手动设置SOAPAction #

从SoapUI请求可以看到SOAPAction: ""，JAX-WS客户端可能未正确设置该值，可通过请求上下文手动配置：

bindingProvider.getRequestContext().put(BindingProvider.SOAPACTION_URI_PROPERTY, "");

4. 启用日志排查实际请求 #

添加JAX-WS日志配置，查看实际发送的请求Header是否与SoapUI一致，确认自定义Header是否真的被发送：

• 在logging.properties中添加：

  com.sun.xml.ws.transport.http.client.HttpTransportPipe.level = FINE
  

• 或在Spring Boot的application.properties中配置：

  logging.level.com.sun.xml.ws.transport.http.client.HttpTransportPipe=DEBUG
  

5. 处理Session Cookie（可选） #

从SoapUI响应可以看到服务端返回了JSESSIONID Cookie，部分服务依赖Session鉴权。若需要携带该Cookie，可添加到请求Header中：

// 假设已获取到有效的JSESSIONID值
String jsessionId = "xxx";
requestHeaders.put("Cookie", List.of("JSESSIONID=" + jsessionId));

内容的提问来源于stack exchange，提问作者Thalys Menezes