There seems to be a lot of misunderstanding about Web Service
security. Using password authentication doesn’t prevent
unauthorized users to access your data, while SSL / HTTPS
doesn’t give you any information about who is trying to access
your services. And did you ever think of signing you messages
with a digital signature? In my introductory post I’ve
elaborated on what type of security we’d typically want on Web
Services. In part 1 , I’ve dealt with Username Token
authentication. In this article, I will describe Transport Level
Security (TLS), formerly known as Secure Socket Layer and
message encryption. Lets recap the security requirements I have
discussed in my introduction. The client must be sure it sends
it messages to the correct provider; The provider wants to be
sure that the client is authorized to; The provider wants to be
sure that the client is who it says it is; Both the consumer and
provider want to be sure that the messages can only be
interpreted by each other; Both parties want to be sure