RE: LC 76 - What makes a msg WS-A?

 

> -----Original Message-----
> From: public-ws-addressing-request@w3.org 
> [mailto:public-ws-addressing-request@w3.org] On Behalf Of Rich Salz
> Sent: 15 July 2005 03:37
> To: dorchard@bea.com
> Cc: public-ws-addressing@w3.org
> Subject: RE: LC 76 - What makes a msg WS-A?
> 
> 
> > 	I thought it was clear.  As soon as a single ws-a header is
> > marked with mU, then a fault will be thrown if there are any missing
> > headers like Action.
> 
> I assume you mean "missing and non-defaulted," right?

No. Just missing. Action never gets defaulted.

> 
> Or do we advise that if you want mustUnderstand, then you 
> shouldn't use
> default values but explicitly put in the headers with the 
> default values?

Action doesn't have a default.

> 
> My concern is this:  a client prepares a WSA message leaving things
> like the default wsa:replyto.  The security layer then signs 
> the headers
> and message body.  An adversary intercepts the message and inserts an
> unsigned wsa:replyto header.  It is hard, if not impossible, for most
> implementations to catch this.

Shouldn't receivers only trust what is signed?

Gudge

>         /r$
> 
> -- 
> Rich Salz                  Chief Security Architect
> DataPower Technology       http://www.datapower.com
> XS40 XML Security Gateway  http://www.datapower.com/products/xs40.html
> 
> 
>

Received on Friday, 15 July 2005 05:06:01 UTC