• Post Reply Bookmark Topic Watch Topic
  • New Topic

Web Services Security

 
ILYAS ALI
Greenhorn
Posts: 1
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi All,

I am new to this forum. I wanna ask that if you use HTTPS url to access Web Services then is that enough while talking about Web Servives Security.

Any hint to study the actual technologies that can implement WS Security ???

Thanks in Advance.
 
Ulf Dittmer
Rancher
Posts: 42970
73
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Welcome to JavaRanch.

You have to differentiate between web services security and WS-Security. The former is the general concept of securing web services, while the latter is an OASIS standard that prescribed various security-related features that can be used to achieve web services security. The main features of WS-Security are authentication (both username/password and certificates), signature and encryption.

Since web services are overwhelmingly based on HTTP, the HTTP security features (authentication and encryption via SSL/HTTPS) can also be used. But that should be considered obsolete; these days, to secure a web service, the features of the WS-Security standard should be used. Popular WS engines (like Axis) come with WS-Security support built in.
[ July 05, 2007: Message edited by: Ulf Dittmer ]
 
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!