SOAP Ponderings

SOAP Ponderings

If you ve ever written a remote procedure call (RPC) application, take a moment to reflect on whether you would place your RPC service directly on the Internet. No? Essentially, SOAP is RPC meets HTTP, or COM meets HTTP. You should remember that SOAP applications are Web applications and run in the most hostile of environments. It is incredibly important that you check all input sent to your SOAP methods. Use regular expressions to determine whether the data is valid. The good news is that SOAP method call arguments are typed, and the SOAP engine will stop many instances of bogus data. But you should still validate the data anyway.

Also, if your SOAP services require authentication, make sure your .WSDL (Web Services Description Language) and .DISCO (Web Services Discovery) files are covered by the same authentication settings. Both of these files allow a user or an attacker to determine information about your application, some of which might be sensitive. Therefore, if a user should be authenticated to access your service, the user should be authenticated to read the application metadata.