Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: stcheng@xxxxxxxxxxxxxxxxxxxx (Steven Cheng[MSFT])
- Date: Wed, 18 Oct 2006 07:59:38 GMT
Hi John,
If you only applied SSL/https as the transport channel and not use message
layer security feature in WSE, WSE will certainly send out the soap message
(include username/password credentials) in clearText format. However, I
think SSL/HTTPS should be strong enough for secure the mesages transfering
over the transport layer. If your concern is that some malicious one else
may redirect the request to a fake server with SSL/certificates, then you
can add codelogic in your client application to valiate the server
certificate exposed from the SSL/HTTPS server. The ServicePointManager
class in .net framework provide ServerCertificateValidationCallback event
that can let us add custom code logic to verify the server (which provide
the SSL/HTTPS service channel). And this event will occur at the initial
time when your webservice (or other webclient) which connect to HTTPS/SSL
server through .net webrequest components:
#ServicePointManager.ServerCertificateValidationCallback Property
http://msdn2.microsoft.com/en-us/library/system.net.servicepointmanager.serv
ercertificatevalidationcallback.aspx
#RemoteCertificateValidationCallback Delegate
http://msdn2.microsoft.com/en-us/library/system.net.security.remotecertifica
tevalidationcallback.aspx
Anyway, I also think that you can choose either
SSL/HTTPS(UsernameOverTransport) or message layer
security(UsernameOverCertificate), use both of them may be a bit redundant.
Please feel free to post here if you have any other concerns or ideas on
this.
Sincerely,
Steven Cheng
Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.
.
- References:
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: Dominick Baier
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Prev by Date: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Next by Date: EnvelopedCMS and MailMessage [.NET 2.0 - VB_VS2005]
- Previous by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Next by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Index(es):
Relevant Pages
|
|
