Dangers of SOAP: Payment gateway WSDL sent over HTTPS but all actions are HTTP(netcash.co.za)

netcash.co.za

Dangers of SOAP: Payment gateway WSDL sent over HTTPS but all actions are HTTP

https://www.netcash.co.za/netserv/ncUpload/service.asmx?wsdl

2 comments

I don't think it's a great idea to link directly to the WSDL for what looks like a production system without indicating this in the HN title.

I was expecting an article describing how it is possible to make this mistake - not raw WSDL!

memoryfault14 anni fa

Maybe I'm missing something, but how is this a danger of SOAP? You could misconfigure any endpoint.

SystemOut14 anni fa

I agree. This could happen in any web service, SOAP or otherwise, that pushes back the endpoint URLs as part of a capability discovery mechanism.

mtpettyp14 anni fa

And even if this endpoint (defined in the WSDL) was changed to to https there is nothing stopping you from overriding it and pointing it to any other (possibly unsecure) URL.

vlucas14 anni fa

I thought the exact same thing as soon as I saw the URLs. This could happen with ANY web service that returns URLs, even a REST one with a more HATEOAS-style approach.