|
|
Tuesday, June 11, 2002 |
Simon Fell: "I've updated the web services security story with some input from Justin Rudd. [Greg Reinacker's Weblog] Putting credentials in a SOAP header without an ecrypted channel is a waste of time, but if you have an encrypted channel, you might as well use the channel's authentication support. WS-Security only starts to make sense [much the same as SOAP] when you have intermediaries." Correct. There is a balance here, of course. When you're application requires the ability to be channel independent, things like SOAP and WS-Security are useful. About the only times when an application requires channel independence is when you have multiple hops where each hop may or may not use the same type of channel, or when you simply wish to allow clients a variety of communication options. For the vast majority of single-hop Internet-deployed Web services, channel specific security mechanisms like SSL/TLS are more than adequate.
8:35:22 AM
|
|
|
|