Securing web services applications at the transport level
Transport-level security is a well-known and often used mechanism to secure HTTP Internet and intranet communications. Transport level security can be used to secure web services messages. Transport-level security functionality is independent from functionality that is provided by message-level security (WS-Security) or HTTP basic authentication.
Before you begin
- Use message-level security when security is essential to the Web
service application. HTTP basic authentication uses a user name and
password to authenticate a service client to a secure endpoint. The
basic authentication is encoded in the HTTP request that carries the
SOAP message. When the application server receives the HTTP request,
the user name and password are retrieved and verified using the authentication
mechanism specific to the server.Important: With message-level security, if you are not using the default outbound secure sockets layer (SSL) port of 443, ensure that the dynamic outbound endpoint for SSL is configured properly for your configuration.
- Use transport-level security to enable basic authentication. Transport-level security can be enabled or disabled independently from message-level security. Transport-level security provides minimal security. You can use this configuration when a web service is a client to another web service.
- Use SSL for confidentiality and integrity and HTTP Basic Authentication for authentication.
- Use SSL for confidentiality and integrity and WS-Security for authentication. For example, a Username token or LTPA token can be used for authentication.
- Use WS-Security for both confidentiality and integrity, and authentication.
About this task
Transport level security can be used to secure web services messages. However, transport-level security functionality is independent from functionality that is provided by WS-Security or HTTP Basic Authentication.
SSL and TLS provide security features
including authentication, data protection, and cryptographic token
support for secure HTTP connections. To run with HTTPS, the service
port address must be in the form https://
. The integrity
and confidentiality of transport data, including SOAP messages and
HTTP basic authentication, is confirmed when you use SSL and TLS.
Web services applications can also use Federal Information Processing Standard (FIPS) approved ciphers for more secure TLS connections.
WebSphere® Application Server uses the Java™ Secure Sockets Extension (JSSE) package to support SSL and TLS.
This task is one of several ways that you can configure the HTTP outbound transport level security for a web service acting as a client to another Web service server. You can also configure the HTTP outbound transport level security with an assembly tool or by using the Java properties. If you do not configure the HTTP outbound transport level security, the web services runtime defers to the Java Platform, Enterprise Edition (Java EE) security runtime in the WebSphere product for an effective Secure Sockets Layer (SSL) configuration. If there is no SSL configuration with the Java EE security runtime in the WebSphere product, the Java Secure Socket Extension (JSSE) system properties are used.
You can define additional HTTP transport properties for web services applications. Use the additional properties to manage the connection pool for HTTP outbound connections, configure the content encoding of the HTTP message, enable HTTP persistent connection, and resend the HTTP request when a timeout occurs.