Hi guys
My application use web service as data layer.
E.g. when I need to update user data, the application will call web service like
userws.updateUser(userID, userDataObject).
As you can see, If somebody can get access to the web service, he can use any data for the methods.
What I've got so far is,
1. ssl connection between web service and website
2. each time when website need to call web service, it passes a ID and keyword, which the web service will use to identify the method caller is a 'legal' caller.
3. I am trying to configure the service so that it could respond to specific ip address only.
The thing is that, I still feel the web service is not secure enough.
Could you give me some ideas how I can make it secure please? thanks
...
Go to the complete details ...