CODEWITHSUNDEEP
web-servicesauthenticationsoap
Joannes Vermorel
Joannes Vermorel

Reputation: 9235

Web Services authentication - best practices?

We have SOAP web services in production that are relying on SOAP Headers (containing plain client credentials) for the authentication. The WS are used in heterogeneous environments with .NET/Java/PHP/Python/C++ clients both web app or desktop app.

We are considering a v2 for those WS and I am wondering what are considered as the best practices for WS SOAP authentication? (reasonably secure, yet easy to handle on a wide variety of platforms).

Upvotes: 21

Views: 29470

Answers (3)

James Anderson
James Anderson

Reputation: 27478

The way I have tackled this in the past is to use the standard WS-* features.

Instead of using the authentication feature we set the message header integrity feature on. This requires both sides of the dialog have access to public/private key pair and detects any tampering of the username field in the header. So you can be sure whoever sent the message and set the user id has access to the private key.

This provides a reasonable level of integrity if the keys are managed properly.

Upvotes: 2

David Norman
David Norman

Reputation: 19879

If you have to roll it all yourself and can't use HTTPS, I'd suggest the hash-based UsernameToken portion of WS-Security. It's pretty secure and fairly easy to implement as long as your libraries have the hashing functions.

If you're doing web services, I wouldn't rely on HTTP for authentication.

WS-Security as a whole is way too big.

Upvotes: 4

Dave Dunkin
Dave Dunkin

Reputation: 1107

The easiest way to handle it across a variety of platforms is to use HTTP basic authentication and HTTPS for the transport layer. WS-Security would be good if your needs go beyond simple username/password but the support is going to vary quite a bit between platforms. HTTP authentication is supported by every decent SOAP implementation.

Upvotes: 15

Related Questions