I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API.
This is the WSDL I need to send a message:
<?xml version="1.0"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" soap:encodingStyle="http://www.w3.org/2003/05/soap-encoding"> <soap:Header> <authenticate_user xmlns="http://www.example.net/ns/"> <username>MY_USERNAME</username> <password>MY_PASSWORD</password> </authenticate_user> </soap:Header> <soap:Body> <send_sms xmlns:m="http://www.example.net/ns/"> <user_id>???</user_id> <from>???</from> <to>???</to> <message>Example text.</message> </send_sms> </soap:Body> </soap:Envelope>
The provider has published a PHP-script containing a class and function to easily access the API without having to deal with WSDL (I am rewriting that script into Rust).
But I see that in the PHP-script all the requests to the API are send in plain-HTTP. When I execute that script on my localhost and intercept it with Wireshark I can indeed see this part
<password>MY_PASSWORD</password> of the request, exposing my password.
My question is: Is this a problem? When you have server-side PHP code running which calls an API, is it a problem if this is not over SSL?