Web Services Security

[ILYAS ALI]

Hi All,

I am new to this forum. I wanna ask that if you use HTTPS url to access Web Services then is that enough while talking about Web Servives Security.

Any hint to study the actual technologies that can implement WS Security ???

Thanks in Advance.

[Ulf Dittmer]

Welcome to JavaRanch.

You have to differentiate between web services security and WS-Security. The former is the general concept of securing web services, while the latter is an OASIS standard that prescribed various security-related features that can be used to achieve web services security. The main features of WS-Security are authentication (both username/password and certificates), signature and encryption.

Since web services are overwhelmingly based on HTTP, the HTTP security features (authentication and encryption via SSL/HTTPS) can also be used. But that should be considered obsolete; these days, to secure a web service, the features of the WS-Security standard should be used. Popular WS engines (like Axis) come with WS-Security support built in.
[ July 05, 2007: Message edited by: Ulf Dittmer ]