CODEWITHSUNDEEP
phpsecurity
Alex
Alex

Reputation:

How do you know a soap client is using https/ssl? Using php nusoap library

I'm using a PHP soap toolkit called nusoap (http://sourceforge.net/projects/nusoap), and I have a newbie question.

I am calling a WSDL service, which is running over ssl (e.g. https://server.com/service/method.asmx?WSDL).

Using nusoap, I traced out the request. It looks like this:

POST /service/method.asmx HTTP/1.0
Host: server.com
User-Agent: NuSOAP/0.9.5 (1.123)
Content-Type: text/xml; charset=ISO-8859-1
SOAPAction: "http://software.com/service/Method"
Content-Length: 713

I'm wondering, though, is this being done over SSL, or no?

Upvotes: 0

Views: 907

Answers (2)

derobert
derobert

Reputation: 51197

Use Wireshark to see the actual traffic. Then it'll be fairly obvious if its encrypted or not.

Upvotes: 2

Matthew Read
Matthew Read

Reputation: 1879

SOAPAction: "http://software.com/service/Method" indicates it's probably not using SSL. You'd expect it to have https in that URI. I certainly wouldn't trust it.

Upvotes: 1

Related Questions