What is SOAP Security?

SOAP stands for (Simple Object Access Protocol) and is a messaging protocol for exchanging structured information to implement web services. It uses XML as its primary message format and application layer protocols for message communication. 

The XML message is divided into three parts: 

• Envelope -> Used to define the message structure and how to process it.

• Set of encoding rules -> Used for expressing instances of application-defined datatypes.

• Convention -> Used for representing procedure calls and responses.

SOAP relies on three primary characteristics: extensibility (provides customization), neutrality ( protocol agnostic) & independence (no dependency on any programming language). 

Working of SOAP

The application sends a SOAP request to a server with web services enabled with the parameters for a search. The server returns a SOAP response (an XML-formatted document with the resulting data). The resulting information is in machine-parsable format, therefore, the requesting application would be able to integrate directly.

SOAP is also an extension of Web Security Standard protocols. WS Standard protocols supplement the primary protocol.  Therefore SOAP is used as an interface by both public and private APIs. SOAP APIs give better structure, datatype control, and a defined standard. 

SOAP APIs merge a WSDL (Web Services Description Langauge) with XML Schema, providing a potent web service messages are traded using specified procedures and field types. As WSDL is machine-readable, a SOAP client can determine what operations are possible and the data needed to meet the call and then present data to the user. To counter is also used to generate human-readable documentation for SOAP APIs. Web Standard (WS) Security is critical in ensuring SOAP Security. WS-Security is a set of principles for standardizing SOAP messages using authentication and confidentiality processes. Digital signatures, XML encryption, and X.509 certificates are a few secure methods. XML encryption prevents unauthorized users from accessing & reading data. 

SOAP API Example: 

<?xml version="1.0"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://www.w3.org/2001/12/soap-envelope" SOAP-ENV:encodingStyle=" http://www.w3.org/2001/12/soap-encoding">
          <soap:Body>
        <HealthybyteWebService xmlns="http://example.org/">
                  <BlogID>int</BlogID>
                </HealthybyteWebService>
          </soap:Body>
</SOAP-ENV:Envelope>

The most common SOAP API vulnerabilities include:

• SOAP Injections

  • SQL Injection

  • XML Injection

  • XAML Injection

  • Command Injection

• SOAP Action Spoofing

• SAML Vulnerabilities

• Replay Attacks

• Cross-Site Scripting

• Broken Access and Authorization

• Denial of Service (DoS)

Advantages

• SOAP's neutral factor makes it possible to work with any transport protocol. For example, protocols such as SMTP, HTTP/S, JMS, and message queues.

• SOAP tunnels quickly through existing firewalls and proxies and consequently doesn't require modifying the general computing and communication infrastructures when combined with HTTP post/response exchanges for processing HTTP post/response exchanges.

• SOAP is available to facilitate XML, including effortless internationalization and extensibility with XML Namespaces.

Disadvantages

• The XML Infoset is serialized as XML when using standard implementation and the default SOAP/HTTP binding.

• The performance of a particular case of XML can be improved by embedding it with binary objects and Message Transmission Optimization Mechanism.

• The functions of the interacting parties are specified when relying on the HTTP protocol and not using WS Addressing or an Enterprise Service Bus.

• The verbosity of the protocol, gradually parsing speed of XML, and absence of a standardized interaction model make SOAP a more complex service than a service like REST.