From: roland.schmitt@...
Date: 2006-02-10T00:58:23+09:00
Subject: Re: Writing Secure Web Services

Hello Scott,

> I know this is Ruby-specific, but we plan to implement this system
> using Ruby and ActionWebService.  We need to create a secure web
> service for B2B integration (ick, sounds too Enterprise-y).  The
> request follows the following path:
>
> Client Web Site -> Our Web Service (ActiveWebService) -> Our Database,
> and back.
>
> We'd like to eliminate the overhead of a challenge/response type of
> system. We've come up with this:
>
> The client GPG Signs a UUID+Time. This way an interception of the token
> is worthless since it's only good for one request. Since the time
> portion of tokens are sequential, we don't need to store a lot of them.
> We can just provide a 1 minute window around our latest token.
>
> So tokens are only good for one request. We have to store the latest
> token. Since the tokens are signed, tokens can't be generated by a
> third party without first compromising the client's private key.
>
> Can anyone poke holes in this idea for us? Or do you have any better
> ideas?

Another idea is using wss4r with ActiveWebService. You can then encrypt
and/or sign the requests/responses from both client and server. WSS4R
uses certificates for signing and encryption. Another advantage is that
it is conform to some web service specs, so you can use other clients
like java or .NET.

There is an example ActiveWebService/rails application that uses
encryption and signing and also clients in ruby and C#/.NET.


[1] http://www.rubyforge.org/projects/wss4r

Regards,
Roland