Improving Web Application Security: Threats and - CGISecurity

706 Improving Web Application Security: Threats and CountermeasuresAuthenticationCheck DescriptionWeb services that support restricted operations or provide sensitive data supportauthentication.If plain text credentials are passed in SOAP headers, SOAP messages are only passed overencrypted communication channels, for example, using SSL.Basic authentication is only used over an encrypted communication channel.Authentication mechanisms that use SOAP headers are based on Web Services Security (WSSecurity) using the Web Services Enhancements WSE).AuthorizationCheck DescriptionWeb services that support restricted operations or provide sensitive data supportauthorization.Where appropriate, access to Web service is restricted using URL authorization or fileauthorization if Windows authentication is used.Where appropriate, access to publicly accessible Web methods is restricted usingdeclarative principle permission demands.Sensitive DataCheck DescriptionSensitive data in Web service SOAP messages is encrypted using XML encryptionOR messages are only passed over encrypted communication channels (for example,using SSL.)Parameter ManipulationCheck DescriptionIf parameter manipulation is a concern (particularly where messages are routed throughmultiple intermediary nodes across multiple network links). Messages are digitally signed toensure that they cannot be tampered with.