Roger's Rules for Web Services

[Anne Thomas Manes <at...@gmail.com>]

Great article by Roger Sippl:

http://www.sdtimes.com/article/special-20051101-01.html

Re: Roger's Rules for Web Services

[Anne Thomas Manes <at...@gmail.com>]

I think it depends on how far reaching you need the services to be.

If you are a company like eBay or Amazon that wants mass consumers to
consume the service, you should [currently] avoid all soap headers -- even
WS-Security. That's because lots of SOAP implementations for scripting
languages don't support WS-Security.

If you are building services that will be consumed by partners or
professional consumers, I think it's quite reasonable to use widely
implemented standard soap headers -- which today means WS-Security. But you
should generally avoid other headers, including pre-standard soap headers
(WS-Addressing, WS-RM, etc), and home-grown non-standard soap headers. But
you should always let your application requirements dictate your decisions.
Depending on the circumstances and the nature of the relationships with the
consumers, it might be more reasonable to use a pre-standard or home-grown
soap header than putting infrastructure info in the soap body. In general,
it's better to use pre-standard headers than home-grown headers.

If you are building services that will be used internally where you have
control over both sides of the conversation, then you definitely should use
WS-Security, and it's better to put infrastructure info into headers than in
the soap body.

Anne

On 11/16/05, Soactive Inc <so...@gmail.com> wrote:
>
> I would interpret this to mean that it may be a bad practice to invent
> your own custom headers (could SOAP or HTTP) that someone is not familar
> with or is not a standard. That said, I agree that any
> security/access-related info needs to be part of the SOAP headers
> (WS-Security/SAML, etc.) or HTTP headers (Basic Auth) but NOT the
> body/payload.
>
> -Arun
>
> On 11/16/05, Paul Barry <ma...@paulbarry.com> wrote:
> >
> > What do you think of this comment?
> >
> > But don't get too creative and stuff names and passwords into cute
> > spaces in headers and such. The more you get inventive here, the
> > harder it is for others to use the services.
> >
> > First of all, is he referring to HTTP headers or SOAP headers.
> > Assuming SOAP headers, if you are using the "user name and password in
> > every call" style, wouldn't it make sense to include that in the SOAP
> > header rather than the body? or is that a bad idea?
> >
> > On 11/13/05, Anne Thomas Manes <at...@gmail.com> wrote:
> > > Great article by Roger Sippl:
> > >
> > > http://www.sdtimes.com/article/special-20051101-01.html
> > >
> >
>
>

Re: Roger's Rules for Web Services

[Soactive Inc <so...@gmail.com>]

I would interpret this to mean that it may be a bad practice to invent your
own custom headers (could SOAP or HTTP) that someone is not familar with or
is not a standard. That said, I agree that any security/access-related info
needs to be part of the SOAP headers (WS-Security/SAML, etc.) or HTTP
headers (Basic Auth) but NOT the body/payload.

-Arun

On 11/16/05, Paul Barry <ma...@paulbarry.com> wrote:
>
> What do you think of this comment?
>
> But don't get too creative and stuff names and passwords into cute
> spaces in headers and such. The more you get inventive here, the
> harder it is for others to use the services.
>
> First of all, is he referring to HTTP headers or SOAP headers.
> Assuming SOAP headers, if you are using the "user name and password in
> every call" style, wouldn't it make sense to include that in the SOAP
> header rather than the body? or is that a bad idea?
>
> On 11/13/05, Anne Thomas Manes <at...@gmail.com> wrote:
> > Great article by Roger Sippl:
> >
> > http://www.sdtimes.com/article/special-20051101-01.html
> >
>

Re: Roger's Rules for Web Services

[Paul Barry <ma...@paulbarry.com>]

What do you think of this comment?

But don't get too creative and stuff names and passwords into cute
spaces in headers and such. The more you get inventive here, the
harder it is for others to use the services.

First of all, is he referring to HTTP headers or SOAP headers. 
Assuming SOAP headers, if you are using the "user name and password in
every call" style, wouldn't it make sense to include that in the SOAP
header rather than the body?  or is that a bad idea?

On 11/13/05, Anne Thomas Manes <at...@gmail.com> wrote:
> Great article by Roger Sippl:
>
>  http://www.sdtimes.com/article/special-20051101-01.html
>