推荐的方法来保护 Web 服务？

Question

Do you know what are the best practices in securing webservices?

What I need is some security added in the header of the soap message. (ssl is not an option)

Answer 1

Maybe you can add the

X-Magic-Security-Dust: true

header to your requests.

Seriously though, read Bruce Schneier and maybe repost with clarification.

What's going to be different about the state of Internet and network security three years from now?

I think we're finally past the era where people believe in magic security dust, that all they need to do is buy the right set of products and their network will be imbued with the property of "secure." Security is a process. It's a journey.

Answer 2

You can use XML-Encryption defined by W3C to make sure that your WS Messages stay confidential. Theres also an XML-Signature Standard, also by W3C, which ensures Integrity.