Re: SOAP Errors

I think it is advisable that security protocol failures are silently
discarded so as not to provide a potential intruder of useful
information/feedback. However, it is useful to send an out of band message
to the administrator of the security infrastructure of the failure so that
an audit trail is produced.

Marty

-----Original Message-----
From: Discussion of implementing SOAP applications today
[mailto:[email protected]]On Behalf Of Paul Faulkner
Sent: Thursday, November 14, 2002 12:24 PM
To: [email protected]
Subject: [SOAP] SOAP Errors


What is the SOAP standard for handling errors.  Let say I implement PKI
security for my SOAP Web Service and someone sends a message that fails
security.  Do I reply with an error letting them know this or simply
discard the message?

Obviously both have merits and pitfalls.  The biggest concern I have is
someone flooding my webservice with invalid requests and having to reply to
each request.

What is the industry standard for these situations?

You can read messages from the SOAP archive, unsubscribe from SOAP, or
subscribe to other
DevelopMentor lists at http://discuss.develop.com.

You can read messages from the SOAP archive, unsubscribe from SOAP, or subscribe to other
DevelopMentor lists at http://discuss.develop.com.