Problem solve Get help with specific problems with your technologies, process and projects.

Why can't I just use SSL to protect my Web services?

Why can't I just use SSL to protect my Web services?
The Secure Sockets Layer, SSL, may be used in certain, restricted cases for protecting a Web services message on the wire. However, SSL has a number of limitations when it is used with Web services. First, SSL is a point-to-point protocol, that is, at each step the message is decrypted and a new SSL connection is set up. If a message goes through multiple intermediates, which is expected behavior in Web services, then the message will be exposed to each intermediate, which may be a severe vulnerability. Second, SSL encrypts the whole message, which will be expensive for a large message, whereas Web services security supports encrypting selected parts of the message. Third, SSL does not support authorization, whereas there are Web services specifications that specifically support authorization, such as the eXtensible , Access Control Markup Language, XACML. Fourth Web services security is XML based which is the language of Web services, making it a more congruent fit. That said, there are times when SSL is an alternative to Web services security and is recommended to be used in conjunction with Web services security in certain cases.
This was last published in May 2003

Dig Deeper on Web application and API security best practices

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.