0

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API.

This is the WSDL I need to send a message:

<?xml version="1.0"?>
<soap:Envelope
    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://www.w3.org/2003/05/soap-encoding">
    <soap:Header>
        <authenticate_user
            xmlns="http://www.example.net/ns/">
            <username>MY_USERNAME</username>
            <password>MY_PASSWORD</password>
        </authenticate_user>
    </soap:Header>
    <soap:Body>
        <send_sms
            xmlns:m="http://www.example.net/ns/">
            <user_id>???</user_id>
            <from>???</from>
            <to>???</to>
            <message>Example text.</message>
        </send_sms>
    </soap:Body>
</soap:Envelope>

The provider has published a PHP-script containing a class and function to easily access the API without having to deal with WSDL (I am rewriting that script into Rust).

But I see that in the PHP-script all the requests to the API are send in plain-HTTP. When I execute that script on my localhost and intercept it with Wireshark I can indeed see this part <password>MY_PASSWORD</password> of the request, exposing my password.

My question is: Is this a problem? When you have server-side PHP code running which calls an API, is it a problem if this is not over SSL?

3
  • If you use http (instead of https), then any passive eavesdropper along the path can see the password that you are sending in the request (as you saw yourself using wireshark). You should use https to connect, so that the connection is secured. The fact that you are connecting from a server doesn't make a difference - in this case, your server is simply acting as a client.
    – mti2935
    May 16 at 15:27
  • Why are you using SOAP, if you are actually ignoring it? 😉 There is WSSE standard that defines "<wsse:UsernameToken>" element that should be used for user/password authentication. Instead of using standard, your services introduces its own schema. What are the reasons for that?
    – mentallurg
    May 16 at 17:11
  • Always use TLS by default, what will remove headaches. The only case of use non encrypted communication is for testing purposes or debugging. for the rest TLS :)
    – camp0
    May 17 at 8:26

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.