3 ms·

SOAP is perfect for integration between organisations (for internal communication other formats is usually better). It supports schema first in a natural way me

by wwn_se 20d ago

SOAP is perfect for integration between organisations (for internal communication other formats is usually better). It supports schema first in a natural way meaning as long as both parties agree on a schema nothing else really need to be shared. XML is mature and supported in all languages with code generation its more or less transparent to the dev. WS auth is horrible though and a bearer token (and tls) in the header is definitely the way to go.

throwaway7356 20d ago
> XML is mature and supported in all languages with code generation its more or less transparent to the dev. No, XML is still not mature. They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. It basically doesn't handle untrusted input well, like SQL built from strings without parameter bindings. I hope this is reasonable and doesn't use XML Security or similar extensions that add a whole stack of other security issues on top that everyone reimplements when adding SAML support.
- xienze 20d ago
  > They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. Who is doing this reimplementation? You're supposed to be using mature, battle-tested libraries for parsing these formats. Writing your own parser for just about any format is a fool's errand when good implementations that have already addressed these issues exist. Even a simple format like JSON is not immune to performance, safety, and correctness pitfalls.
  - throwaway7356 20d ago
    Many libraries still have unsafe defaults. They come from the XML-age where security concerns were minor (SQL injection was still new to most!) Using XML in a safe way requires you to study what is wrong with XML first. That is not what many people do.
- apelapan 20d ago
  XML is not perfect, but it is mature. It has been the same for a very long time, all the warts and gotchas are well known. You need to be careful about the same things in 2026 as you did back in 2006.

by wwn_se 20d ago

throwaway7356 20d ago

> XML is mature and supported in all languages with code generation its more or less transparent to the dev. No, XML is still not mature. They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. It basically doesn't handle untrusted input well, like SQL built from strings without parameter bindings. I hope this is reasonable and doesn't use XML Security or similar extensions that add a whole stack of other security issues on top that everyone reimplements when adding SAML support.

xienze 20d ago
> They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. Who is doing this reimplementation? You're supposed to be using mature, battle-tested libraries for parsing these formats. Writing your own parser for just about any format is a fool's errand when good implementations that have already addressed these issues exist. Even a simple format like JSON is not immune to performance, safety, and correctness pitfalls.
- throwaway7356 20d ago
  Many libraries still have unsafe defaults. They come from the XML-age where security concerns were minor (SQL injection was still new to most!) Using XML in a safe way requires you to study what is wrong with XML first. That is not what many people do.
apelapan 20d ago
XML is not perfect, but it is mature. It has been the same for a very long time, all the warts and gotchas are well known. You need to be careful about the same things in 2026 as you did back in 2006.