As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as:
- XML-Encryption
- XML-Signature
- SAML
Are there any security standards for RESTful services?
-
1Depends on whose recommendations you'd want to adhere to, but yes, even NSA has some (PDF). There's even such chapters as Guidance for using HEAD and Consideration for use of SOAP :D– TildalWaveMar 24, 2014 at 0:22
Add a comment
|
2 Answers
OWASP has some very good guidelines concerning the security of REST services.
-
The link is down. Maybe this: cheatsheetseries.owasp.org/cheatsheets/…– bombenMay 11, 2020 at 7:09
In addition to the mentioned documents, these standards may be of your interest:
- JSON Web Encryption (https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-encryption-24) and JSON Web Signature (https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-signature-24) are counterparts to XML Signature and XML Encryption. They are still under development, but you can already find some implementations of these standards which give you the possibility to apply crypto directly in JSON messages...
- OpenID and OAuth: used for authentication and authorization purposes, similar to SAML
