Re: web service security

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: casey chesnut (casey_at_MORE_spam_PLEASEbrains-N-brawn.com)
Date: 07/22/04 

Date: Thu, 22 Jul 2004 10:54:01 -0500

WSE will do Xml-Encryption as well.
casey

"Dale" <DalePres@eMmeSseNn.com> wrote in message
news:2C97DFBD-A9A9-4D3C-B8FD-B7F626B52CCC@microsoft.com...
> You may also want to look into Soap Extensions. With Soap Extensions you
could encrypt the entire message and not only would the hacker be unable to
interject false values, he would be unable to read the transmitted data as
well.
> --
> Dale Preston
> MCAD C#
> MCSE, MCDBA
>
>
> "casey chesnut" wrote:
>
> > yes, by adding an Xml-Signature.
> > a Signature would be used to sign the transaction #.
> > when the message was intercepted, and the transaction # was changed,
then
> > the signature would break.
> > the server would try to verify the signature, it would fail, and it
would
> > stop processing this request.
> > you can do this today with WSE 2.0.
> > the client would pass a UsernameToken which had signed the message.
> > i believe there is a WSE sample called UsernameSigning which does
exactly
> > that.
> > all you would have to do is add the Transaction header, and make sure
that
> > the element was signed to.
> > the WSE docs show how to sign additional elements of the SoapMessage.
> > Thanks,
> > casey
> > http://www.brains-N-brawn.com
> >
> >
> > "chuck" <chuck@discussions.microsoft.com> wrote in message
> > news:9733D5EF-AAE9-4C77-8604-6145D4D11D8C@microsoft.com...
> > > I have a question about the security of soap message.
> > >
> > > Let say someone sent a soap message of a store's daily-transaction
across
> > network with soap header containing username and hash password.
> > >
> > > Then a spy stole the soap message and assumed username and hash
password
> > is good. Change the number on the daily-transaction and resent it to the
web
> > service. Is there some way we can prevent this from happening?
> > > tks,
> > > chuck
> >
> >
> >

Relevant Pages

  • Re: DIME attachment
    ... > there is already a sample with the spWse test code. ... > it calls the Attachments sample in WSE 2.0. ... >> Casey, ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: UsernameToken key generation
    ... stupid waste of time. ... > my CF code can validate an XmlSignature created by WSE 2.0 Release, ... > per Hervey's blog: ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Ability to get/set SOAP body xml data at a client program
    ... you can also use a SoapExtension (without WSE) and get access to the Stream ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: WSE 2.0 from the Compact Framework
    ... Way to go, Casey! ... > it has been updated for WSE 2.0 and supports WS-Addressing, ... > i've got an article (with client-side code) that shows how to call every ...
    (microsoft.public.dotnet.framework.webservices.enhancements)