RE: Security Question

Security QuestionHi Guys,
     I am not the active participant of this group...but I am really
interested in knowing the underlying security issues in web services
architecture...I am working on my  thesis ..if I get the enough information
and help that would be a great help....

thanks,
Pratik
  -----Original Message-----
  From: [email protected] [mailto:[email protected]]On
Behalf Of Cutler, Roger (RogerCutler)
  Sent: Monday, August 05, 2002 11:18 AM
  To: [email protected]
  Subject: Security Question


  I've got a question about security that may reflect some misconception on
my part -- but here goes anyway:

  I think that the XML payload of the response from a web service -- or
indeed I suppose the message that invokes it -- may be validated by a
schema.  If so, that schema can add data via defaults and/or fixed values.
How is this secured?

  Let me be more specific with a contrived example:  Suppose we are
purchasing widgets via a web service and in the XML document you specify "1"
for the amount to purchase.  However, suppose the schema has a default value
of "Each" that explains the meaning of the "1".  Now suppose that either
from malicious tampering or through the use of a schema intended for a
different audience that default (which is on the seller side) is changed to
"dozen".  Now the "1" really means 12 items, which is a lot more expensive.

  This is obviously contrived and dumb, but I think it illustrates the fact
that schemas can affect data.

  So how is this secured?  Can the buyer in the context of the message
unambiguously specify what schema must be used for validation and have some
sort of check that it was the right one?  Can it be secured?