Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 345SummaryWS-Security is the emerging standard for Web services security. The specificationdefines options for authentication by passing security tokens in a standard way usingSOAP headers. Tokens can include user name and password credentials, Kerberostickets, X.509 certificates, or custom tokens. WS-Security also addresses messageprivacy and integrity issues. You can encrypt whole or partial messages to provideprivacy, and digitally sign them to provide integrity.In intranet scenarios, where you are in control of both endpoints, platform levelsecurity options such as Windows authentication, can be used. For more complexscenarios where you do not control both endpoints and where messages are routedthrough intermediate application nodes, message level solutions are required. Thefollowing section, “Additional References,” lists the Web sites you can use to trackthe emerging WS-Security standard and the associated WSE tool kit that allows youto build solutions that conform to this and other emerging Web service standards.Additional ResourcesFor more information, see the following resources:●●●●●●For a printable checklist, see “Checklist: Securing Web Services” in the“Checklists” section of this guide.You can download the WSE at the Microsoft Web Services Developer Center homepage at http://msdn.microsoft.com/webservices.For information on authentication, authorization and secure communication forWeb services see the “Web Services Security” section in “Microsoft patterns &practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetch10.asp.For articles specific to Web Services security, see the MSDN articles athttp://msdn.microsoft.com/webservices/building/security/default.aspx.For articles specific to Web Services Enhancements, see the MSDN articles athttp://msdn.microsoft.com/webservices/building/wse/default.aspx.For information on using SSL with Web Services, see “How to Call a Web ServiceUsing SSL” in the “How To” section of “Microsoft patterns & practices Volume I,Building Secure ASP.NET Applications: Authentication, Authorization, and SecureCommunication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT14.asp.