Hi, JBoss processes the HandlerTypes in the following order for JAXWS: POST ENDPOINT PRE Since the POST handler needs to parse some information from the soap message to identify the ENDPOINT handler chain to call, you should do your decrypting at the level of the POST handler. To do this, you can annotate your webservice class with @EndpointConfig and define your post handlers in the file standard-jaxws-endpoint-config.xml under META-INF Alternatively, to stay independent from JBoss specific code (ie no dependency to JBoss), you do the below configuration at the level of the deployment descriptors, by modifying the file standard-jaxws-endpoint-config.xml under [JBOSS_HOME]\server\[type]\deployers\jbossws.deployer\META-INF (path differs for JBoss 4.3 ... but same file name) and adding your post-handler chain (example below). <endpoint-config> | <config-name>Murex Security Handlers</config-name> | <post-handler-chains> | <javaee:handler-chain> | <javaee:protocol-bindings>##SOAP11_HTTP</javaee:protocol-bindings> | <javaee:handler> | <javaee:handler-name>My Security Handler</javaee:handler-name> | <javaee:handler-class>package.security.MySecurityClass</javaee:handler-class> | </javaee:handler> | </javaee:handler-chain> | </post-handler-chains> | </endpoint-config> The Config-name you create should be referenced in your web.xml file inside your war file such as the following: <context-param> | <param-name>jbossws-config-name</param-name> | <param-value>My Security Handler</param-value> | </context-param> Cheers. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4250884#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...