They used it as an example of an IMPLEMNTATION problem. SOAP per se is nto bad I hearthem say jsut as they did not say scripts were bad. What they said very celarly, early on, was "separate control from data". SOAP is poorly implemented because it uses a HTTP (a data channel) to send RPC (Control information) effectively by passing the control-oriented security whcih is different an tighter and going through the data-oriented security whcih doesn't scan for procedure integrity. An analogy would be letting some airline passengers skip the security checks at the gate and let them go through the employee gate to board a plane. Surest way we know to get hijacked or bombed. Same with software and why M$ products leak like a sieve.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/315/10154#10154