https post or https soap to access xml data

blackhorse

I used to use curl to sumbit the username and password as post to and get the xml response back from https urls.

How about soap xml web services on https?

If xml web services is on https, and I create a soap client, and then sumbit my credentials through soap, would it be as secure as the https post?

For example, something like that

$c = new SoapClient('https://www.somebodyssite.com/member.asmx?wsdl');

$result = $c->GetMembers(array('userName' => 'myname', 'password' => 'mypassword'));

That would be the same as using https post to submit the username and password in terms of security?

Thanks!

dagon

blackhorse;10950297 wrote:
That would be the same as using https post to submit the username and password in terms of security?

yes.

blackhorse

Dagon, thanks! Does that mean I don't need to use curl here if I use soap like in my above example?

I googled, but some posts said that I still need to use curl if xml web service (soap) is on https?

dagon

blackhorse;10950300 wrote:
Dagon, thanks! Does that mean I don't need to use curl here if I use soap like in my above example?

I googled, but some posts said that I still need to use curl if xml web service (soap) is on https?

you can use curl or soap to connect to a soap service

PHP Web Services Without SOAP << didn't read it but may help.

blackhorse

To dig into the "detail" of the following 2 lines.

$c = new SoapClient('https://www.somebodyssite.com/member.asmx?wsdl');

//this line opens a secured channel for soap client and soap server

$result = $c->GetMembers(array('userName' => 'myname', 'password' => 'mypassword'));

//this line, client sends the username and password in the secured channel and get the response back in the secured channel.

I can simply use this soap method without curl, am I right? I don't have to do anything different from my side. if the soap url is on https, it is secured. if the soap url is on http, it is not secured. From my side as a user of this soap server, I don't need to change any codes?

Thanks!

dagon

curl needs to be installed for soap on php, but otherwise yup

blackhorse

Thanks a lot!

blackhorse

First Question:

dagon;10950306 wrote:
curl needs to be installed for soap on php, but otherwise yup

The reason that curl need to be installed for soap on htttps is that due to I would need to use this to create the soap client connect to https

$client = new SoapClient("some.wsdl", array('local_cert'    => "cert_key.pem"));

And this option, array('local_cert' => "cert_key.pem"), need curl to be installed to work?

Second Question:

//this is for soap client on http with username and password authentication. Is this only for http, not for https, right?

$client = new SoapClient("some.wsdl", array('login'          => "some_name",
                                            'password'       => "some_password"));

//this is for soap client on https

$client = new SoapClient("some.wsdl", array('local_cert'     => "cert_key.pem"));

To use username and password authentication on https, I have to take two steps, 1) make the https connection using this

$client = new SoapClient("some.wsdl", array('local_cert'     => "cert_key.pem"));

to create the https soap client first. 2) and for the username and password authentication part, the soap server has to write a customer method? like in my first post

$result = $c->GetMembers(array('userName' => 'myname', 'password' => 'mypassword'));

Right?

Thanks!

dagon

all your questions seem to be of the type "is this right" to which i always reply, try it and see.