W3C home > Mailing lists > Public > public-ws-addressing@w3.org > July 2005

RE: LC 76 - What makes a msg WS-A?

From: Martin Gudgin <mgudgin@microsoft.com>
Date: Thu, 14 Jul 2005 22:04:36 -0700
Message-ID: <DD35CC66F54D8248B6E04232892B633806575382@RED-MSG-43.redmond.corp.microsoft.com>
To: "Rich Salz" <rsalz@datapower.com>, <dorchard@bea.com>
Cc: <public-ws-addressing@w3.org>

 

> -----Original Message-----
> From: public-ws-addressing-request@w3.org 
> [mailto:public-ws-addressing-request@w3.org] On Behalf Of Rich Salz
> Sent: 15 July 2005 03:37
> To: dorchard@bea.com
> Cc: public-ws-addressing@w3.org
> Subject: RE: LC 76 - What makes a msg WS-A?
> 
> 
> > 	I thought it was clear.  As soon as a single ws-a header is
> > marked with mU, then a fault will be thrown if there are any missing
> > headers like Action.
> 
> I assume you mean "missing and non-defaulted," right?

No. Just missing. Action never gets defaulted.

> 
> Or do we advise that if you want mustUnderstand, then you 
> shouldn't use
> default values but explicitly put in the headers with the 
> default values?

Action doesn't have a default.

> 
> My concern is this:  a client prepares a WSA message leaving things
> like the default wsa:replyto.  The security layer then signs 
> the headers
> and message body.  An adversary intercepts the message and inserts an
> unsigned wsa:replyto header.  It is hard, if not impossible, for most
> implementations to catch this.

Shouldn't receivers only trust what is signed?

Gudge

>         /r$
> 
> -- 
> Rich Salz                  Chief Security Architect
> DataPower Technology       http://www.datapower.com
> XS40 XML Security Gateway  http://www.datapower.com/products/xs40.html
> 
> 
> 
Received on Friday, 15 July 2005 05:06:01 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 18:35:06 GMT