secure webservice

Nick,

I have just finished a project with similar requirement. The problem here is that it appears almost impossible to specify soap-headers you want to accept in your WSDL.

If I am not wrong, thats what the problem you are facing?

Nick,
As I have suggested before, give a user name and password arguments for the functions that you require. When the web service is called, you can check the Database for the valid combination and return the data accordingly.

-Prasanth

How can I use this code in coldfusion for websecurity.

<soap:Envelope xmlns:soap=" http://schemas.xmlsoap.org/soap/
envelope/">
<soap:Header>
<AuthHeader xmlns=" http://tempuri.org/">
<UserName>jeff</UserName>
<Password>imbatman</Password>
</AuthHeader>
</soap:Header>
<soap:Body>
<GetQuote xmlns=" http://tempuri.org/">
<symbol>msft</symbol>
</GetQuote>
</soap:Body>
</soap:Envelope>

quote:

---

Originally posted by: Nick201
How to secure webservice. I try using coldfusion administrator . I mean when i register webservice i put userid and password. But it doesn't work. Is there any other way to secure it

---

Secure it against what?

But if some one calling my webservice then how can i pass userid and password. Because they are not using coldfusion. Let say they are using .Net how they can pass userid and password, which i am passing in cfinvoke.

The user and password in the CFIDE administrator are used for accessing web services which require basic authentication.

To secure web services you are publishing you should rely on the authentication mechanisms (such as basic authentication or Windows authentication) supported by your web server (IIS or Apache). See your web servers documentation or Chapter 48 of the ColdFusion Developer’s Guide under and the topic "Securing your web services". Note that basic authentication is the most commonly supported type and can be used by Windows and *nix systems.

http://livedocs.adobe.com/coldfusion/8/cf8_devguide.pdf