5.1 Security Considerations for Implementers

The following security consideration specifications apply to this profile document:

This profile document does not describe how to provide message integrity and message confidentiality services in SOAP messages. Message integrity and confidentiality services are assumed to be provided by the underlying transport protocol, and, as a result, implementers of the Lightweight Web Services Security Profile need to implement appropriate message confidentiality measures.

This profile document uses a range of cryptographic algorithms. Some of these algorithms might be considered weak depending on the security threats involved in specific scenarios. This profile document does not classify various cryptographic algorithms or prescribe them per usage scenarios.

This profile document specifies partial validation of SAML claims as specified in section 2.2.1.6 of the document. Before accepting a claim, full validation according to [SAMLCore] section 2 and [SAMLToken1.1] section 3 should be performed by higher-layer application protocols.

This profile document does not specify support for signing parts of a SOAP message body. The <To> header is also not signed when security tokens  with symmetric keys are used. This lack of correlation can lead to attacks that involve splitting and reuse of parts of a SOAP message.

Security contexts that are established according to section 2.2.2.1.2 require the server to allocate state on behalf of the client to cache the established context. If the state is unbound, a malicious client can potentially exhaust server resources.