RE: Security Issues in Web-Services

> -----Original Message-----
> From: Naresh Agarwal [mailto:nagarwal@in.firstrain.com]
[snip]

> 4)  Most SOAP implementation use HTTP as transport protocol and hence
> can not use TLS. 

This is not true.  You can have an implementation where SOAP messages
are the payload of TLS, which already assumes a reliable transport,
e.g. TCP.  Thus HTTP doesn't even have come into the picture.
That is, TLS can be used to securely transport SOAP messages
with or without HTTP!

> Is there any soap implementation, which supports HTTPS?

HTTPS is the scheme for HTTP over SSL/TLS.  So any implementation
that fits SOAP messages into HTTP message bodies and then fits the
HTTP messages into SSL/TLS payloads will do.  I'll leave it to
others to identify the products by name.

Joe Hui
Exodus, a Cable & Wireless service

Received on Friday, 8 March 2002 13:59:42 UTC