Loading ...
Sorry, an error occurred while loading the content.

Re: [soapbuilders] question re: SOAP attachments

Expand Messages
  • Rich Salz
    ... Sure, as long as the SOAP receiver can always trust that the SOAP sender will not send it a malicious URL that might (a) be something the client can t
    Message 1 of 14 , Sep 3, 2001
    • 0 Attachment
      > if i want to pass a MIME file between nodes, i can simply pass the URL of
      > the mime file to the server and the server can do an HTTP GET to load
      > the file.

      Sure, as long as the SOAP receiver can always trust that the SOAP sender
      will not send it a "malicious" URL that might (a) be something the
      client can't read, but the server can; (b) be something the server would
      be "embarassed" to fetch ('Graham, why is your server constantly going
      to "hotwax.com"?), etc.

      In addition, once the data is no longer directly included, it's
      inherently less reliable, it's hard to deal with signing/encryption,
      etc.

      /r$
      --
      Zolera Systems, Securing web services (XML, SOAP, Signatures,
      Encryption)
      http://www.zolera.com
    • graham glass
      hey, what s so bad about hotwax? ;-) ... From: Rich Salz [mailto:rsalz@zolera.com] Sent: Monday, September 03, 2001 7:22 PM To: graham glass Cc:
      Message 2 of 14 , Sep 3, 2001
      • 0 Attachment
        hey, what's so bad about hotwax? ;-)

        -----Original Message-----
        From: Rich Salz [mailto:rsalz@...]
        Sent: Monday, September 03, 2001 7:22 PM
        To: graham glass
        Cc: soapbuilders@yahoogroups.com
        Subject: Re: [soapbuilders] question re: SOAP attachments


        > if i want to pass a MIME file between nodes, i can simply pass the URL of
        > the mime file to the server and the server can do an HTTP GET to load
        > the file.

        Sure, as long as the SOAP receiver can always trust that the SOAP sender
        will not send it a "malicious" URL that might (a) be something the
        client can't read, but the server can; (b) be something the server would
        be "embarassed" to fetch ('Graham, why is your server constantly going
        to "hotwax.com"?), etc.

        In addition, once the data is no longer directly included, it's
        inherently less reliable, it's hard to deal with signing/encryption,
        etc.

        /r$
        --
        Zolera Systems, Securing web services (XML, SOAP, Signatures,
        Encryption)
        http://www.zolera.com
      • radosek@yahoo.com
        You can look at WASP Programmers Guide [1] - especially to the chapter 3.5. Using MIME Multipart/Related Content Sending and Receiving [2]. There is a WSDL
        Message 3 of 14 , Sep 4, 2001
        • 0 Attachment
          You can look at WASP Programmers Guide [1] - especially to the
          chapter 3.5. "Using MIME Multipart/Related Content Sending and
          Receiving" [2]. There is a WSDL example how MIME attachments are used
          in WSDL. This WSDL can be used for SOAP with Attachments as well.

          Comments?

          Radovan
          http://www.idoox.com


          [1] http://www.idoox.com/eap/wasp/doc/programmers_guide.html
          [2]
          http://www.idoox.com/eap/wasp/doc/htmldata/programmers_guide_body.html
          #ds_multipart

          --- In soapbuilders@y..., "graham glass" <graham@t...> wrote:
          > does anyone have a sample WSDL that shows an RPC call that
          > sends/receives SOAP attachments?
          >
          > cheers
          > graham
        • Matt Long
          Hi Radovan, In example [2], the parts p0, p1 are typed base64Binary. my question is what impact if any would occur if the parts were typed hexBinary in the
          Message 4 of 14 , Sep 4, 2001
          • 0 Attachment
            Hi Radovan,

            In example [2], the parts p0, p1 are typed base64Binary. my question is
            what impact if any would occur if the parts were typed hexBinary in the
            Idoox implementation?

            -Matt

            > -----Original Message-----
            > From: radosek@... [mailto:radosek@...]
            > Sent: Tuesday, September 04, 2001 7:21 AM
            > To: soapbuilders@yahoogroups.com
            > Subject: [soapbuilders] Re: WSDL for SOAP attachments?
            >
            >
            > You can look at WASP Programmers Guide [1] - especially to the
            > chapter 3.5. "Using MIME Multipart/Related Content Sending and
            > Receiving" [2]. There is a WSDL example how MIME attachments are used
            > in WSDL. This WSDL can be used for SOAP with Attachments as well.
            >
            > Comments?
            >
            > Radovan
            > http://www.idoox.com
            >
            >
            > [1] http://www.idoox.com/eap/wasp/doc/programmers_guide.html
            > [2]
            > http://www.idoox.com/eap/wasp/doc/htmldata/programmers_guide_body.html
            > #ds_multipart
            >
            > --- In soapbuilders@y..., "graham glass" <graham@t...> wrote:
            > > does anyone have a sample WSDL that shows an RPC call that
            > > sends/receives SOAP attachments?
            > >
            > > cheers
            > > graham
            >
            >
            > ------------------------ Yahoo! Groups Sponsor
            > ---------------------~-->
            > Secure your servers with 128-bit SSL encryption! Grab your
            > copy of VeriSign's FREE Guide: "Securing Your Web Site for
            > Business." Get it Now!
            > http://us.click.yahoo.com/n7RbFC/zhwCAA/yigFAA/W6uqlB/TM
            > --------------------------------------------------------------
            > -------~->
            >
            > -----------------------------------------------------------------
            > This group is a forum for builders of SOAP implementations to
            > discuss implementation and interoperability issues. Please
            > stay on-topic.
            >
            > To unsubscribe from this group, send an email to:
            > soapbuilders-unsubscribe@yahoogroups.com
            >
            >
            >
            > Your use of Yahoo! Groups is subject to
            http://docs.yahoo.com/info/terms/
          • djohnson
            Hello All, Matt
            Message 5 of 14 , Sep 4, 2001
            • 0 Attachment
              Hello All, Matt
            • Radovan Janecek
              Yes. You can try it out, just make this demo, replace base64Binary by hexBinary in generated WSDL and run the client. :-) Sincerely Radovan ...
              Message 6 of 14 , Sep 4, 2001
              • 0 Attachment
                Yes. You can try it out, just make this demo, replace
                base64Binary by hexBinary in generated WSDL and run
                the client. :-)

                Sincerely

                Radovan


                --- Matt Long <mlong@...> wrote:
                > Hi Radovan,
                >
                > In example [2], the parts p0, p1 are typed
                > base64Binary. my question is
                > what impact if any would occur if the parts were
                > typed hexBinary in the
                > Idoox implementation?
                >
                > -Matt
                >
                > > -----Original Message-----
                > > From: radosek@... [mailto:radosek@...]
                > > Sent: Tuesday, September 04, 2001 7:21 AM
                > > To: soapbuilders@yahoogroups.com
                > > Subject: [soapbuilders] Re: WSDL for SOAP
                > attachments?
                > >
                > >
                > > You can look at WASP Programmers Guide [1] -
                > especially to the
                > > chapter 3.5. "Using MIME Multipart/Related Content
                > Sending and
                > > Receiving" [2]. There is a WSDL example how MIME
                > attachments are used
                > > in WSDL. This WSDL can be used for SOAP with
                > Attachments as well.
                > >
                > > Comments?
                > >
                > > Radovan
                > > http://www.idoox.com
                > >
                > >
                > > [1]
                >
                http://www.idoox.com/eap/wasp/doc/programmers_guide.html
                > > [2]
                > >
                >
                http://www.idoox.com/eap/wasp/doc/htmldata/programmers_guide_body.html
                > > #ds_multipart
                > >
                > > --- In soapbuilders@y..., "graham glass"
                > <graham@t...> wrote:
                > > > does anyone have a sample WSDL that shows an RPC
                > call that
                > > > sends/receives SOAP attachments?
                > > >
                > > > cheers
                > > > graham
                > >
                > >
                > > ------------------------ Yahoo! Groups Sponsor
                > > ---------------------~-->
                > > Secure your servers with 128-bit SSL encryption!
                > Grab your
                > > copy of VeriSign's FREE Guide: "Securing Your Web
                > Site for
                > > Business." Get it Now!
                > >
                >
                http://us.click.yahoo.com/n7RbFC/zhwCAA/yigFAA/W6uqlB/TM
                > >
                >
                --------------------------------------------------------------
                > > -------~->
                > >
                > >
                >
                -----------------------------------------------------------------
                > > This group is a forum for builders of SOAP
                > implementations to
                > > discuss implementation and interoperability
                > issues. Please
                > > stay on-topic.
                > >
                > > To unsubscribe from this group, send an email to:
                > > soapbuilders-unsubscribe@yahoogroups.com
                > >
                > >
                > >
                > > Your use of Yahoo! Groups is subject to
                > http://docs.yahoo.com/info/terms/
                >
                >


                __________________________________________________
                Do You Yahoo!?
                Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger
                http://im.yahoo.com
              • Pete Hendry
                Graham, sorry for the delay, What about the cases where - the document being attached is not from a file system e.g. from a database (quite common) - it is a
                Message 7 of 14 , Sep 8, 2001
                • 0 Attachment
                  Graham, sorry for the delay,

                  What about the cases where

                  - the document being attached is not from a file system
                  e.g. from a database (quite common)

                  - it is a file but it is secure. i.e. the client used some
                  sort of login over soap to access the service that is
                  providing the file. The deserialization code would
                  not know how to login to the website to retrieve the file

                  - the serverside code receives the object using some third
                  party code as an InputStream, a DataSource or whatever and
                  does not know how the data was stored

                  - the serverside code acts as a proxy to a back-end system
                  that returns the data - for example it may call a mainframe,
                  may call off to an external supplier, may use JMS, etc
                  (similar to first point but out of your control)

                  - the HTTP server hosting the file is down (but the service
                  is up)

                  - and of course, the WSDL for someone elses service that you
                  want to access specifies use of MIME

                  I'm sure there are more to add. Don't be so lazy (you've probably finished it by now ;) ).

                  Pete

                  Rich Salz wrote:
                  >
                  > > if i want to pass a MIME file between nodes, i can simply pass the URL
                  > of
                  > > the mime file to the server and the server can do an HTTP GET to load
                  > > the file.
                  >
                  > Sure, as long as the SOAP receiver can always trust that the SOAP sender
                  > will not send it a "malicious" URL that might (a) be something the
                  > client can't read, but the server can; (b) be something the server would
                  > be "embarassed" to fetch ('Graham, why is your server constantly going
                  > to "hotwax.com"?), etc.
                  >
                  > In addition, once the data is no longer directly included, it's
                  > inherently less reliable, it's hard to deal with signing/encryption,
                  > etc.
                  >
                  > /r$
                  > --
                  > Zolera Systems, Securing web services (XML, SOAP, Signatures,
                  > Encryption)
                  > http://www.zolera.com
                  >
                  >
                  > -----------------------------------------------------------------
                  > This group is a forum for builders of SOAP implementations to discuss
                  > implementation and interoperability issues. Please stay on-topic.
                  >
                  > To unsubscribe from this group, send an email to:
                  > soapbuilders-unsubscribe@yahoogroups.com
                  >
                  >
                  >
                  > Your use of Yahoo! Groups is subject to
                  > http://docs.yahoo.com/info/terms/
                Your message has been successfully submitted and would be delivered to recipients shortly.