I have entered bug report JBWS-1859 to describe a bug we experienced when JBoss is restarted. If client applications are still actively making web service requests during the restart, the handler chain was usually populated with too many copies of the handlers. This doesn't seem to cause a major problem unless WS Security is active. In this case, the first WS Security handler removes the wsse header, so any subsequent WS Security handler throws an exception. As a result, the client receives the message "This service requires <wsse:Security>, which is missing" even though the header was included. Once this error starts to happen, the server will not recover until it's restarted.

Sample client and server code is attached to the bug report, and I've also included patch information on how to fix it.

Bruce