WS Addressing

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Teun - 02 Nov 2004 09:40 GMT

Hello,

I have a question about WSE 2.0.
I have a Web Service client.

In this client I set the replyTo and the fauldTo:
Proxy.Service1 ws = new Proxy.Service1();
ws.RequestSoapContext.Addressing.FaultTo = new Uri(uri);
ws.RequestSoapContext.Addressing.ReplyTo = new Uri(uri);

My webservice is enabled for WSE 2.0. I set this with the WSE 2.0 tool.

When I call the webservice, the FaultTo and ReplyTo-tags are in the Soap
message.

The problem is: the webservice send the response not to the Reply/FaultTo
Uri but he send it to the webserviceclient.

Could you tel me wat the problem is?

Thank you in advance,

Teun

Reply to this Message

Derek Harmon - 05 Nov 2004 06:43 GMT

> When I call the webservice, the FaultTo and ReplyTo-tags are in the Soap
> message.
>
> The problem is: the webservice send the response not to the Reply/FaultTo
> Uri but he send it to the webserviceclient.

Check the configuration file on the server for this web service (assuming this
is a WSE web service), and ensure it contains:

<microsoft.web.services2>
<messaging>
<allowRedirectedResponses enabled="true" />
</messaging>
</microsoft.web.services2>

The web service is not obligated to honor the replyTo and faultTo from the
SOAP request, it can choose to respond to your client directly. What you
describe sounds like allowRedirectedResponses is disabled (this is the
default setting, btw).

When you think about why this is, what if a number of requests to this
web service all pointed to some innocent web site? It could be bombarded
by responses it never asked for. The web service will have been lured into
launching a denial of service attack on the poor site identified by the replyTo
and faultTo URIs.

That's why replyTo and faultTo are disabled by default. They should only
be enabled if the client digitally signs these headers to prevent tampering,
the server can ensure they're legitimate (perhaps by consulting a white list),
and only when the server trusts its clients (heh, heh, that'll be the day. ;-) )

Derek Harmon

Reply to this Message

Rate this thread:

WS Addressing

Free Magazines