Is php soap header encrypted?

Question

I've made a soap call using our own php api. The soap call requires us to send username/password in the soap header, and they only use http, no https.

Does this mean that without changes i would send our header info in cleartext, free for anyone to dump? Or is it encrypted by php itself?

Answer 1

Yes, using http, the entire contents of the request will be in plaintext, including the SOAP headers. You need to use https to make it secure.

SOAP requests are just normal http requests, with a XML structure in the body. It's easily viewable by anyone inspecting the traffic.