Web Service Security (WS-Security) refers to a suite of protocols and standards that protect web services. The cheat sheet below condenses the key points from the OWASP guidance into a quick reference.
| Topic | Key security points |
|---|---|
| Transport confidentiality | Use TLS to protect all data in transit and prevent eavesdropping and tampering. |
| Server authentication | Clients must verify the server's TLS certificate is valid, trusted and correctly matches the host. |
| Client authentication | Authenticate clients using TLS certificates, tokens or credentials, and manage keys securely. |
| Message integrity | Use digital signatures (XML Signature) to ensure messages are not altered in transit. |
| Message confidentiality | Encrypt sensitive elements with XML Encryption where transport security alone is insufficient. |
| Authorisation | Enforce access control on every request; never rely on the client to restrict actions. |
| Schema validation | Validate every message against a strict schema (XSD) before processing. |
| Content validation | Validate input for type, length and format, and reject malformed or unexpected data. |
| Output encoding | Encode output appropriately to prevent injection in downstream consumers. |
| Message size | Limit message and element size to mitigate denial-of-service attacks. |
| XML DoS protection | Guard against recursive payloads and entity-expansion ("billion laughs") attacks. |
| Endpoint security | Harden and patch endpoints, and expose only the services that are required. |
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.