Home / Knowledge hub / SOAP
Knowledge hub
SOAP
An older XML-based API standard still found in banking and enterprise systems.
What it means
SOAP, short for Simple Object Access Protocol, is a standard for exchanging structured messages as XML. A SOAP message has an envelope, an optional header and a body. A WSDL file describes the operations a service offers and the messages it expects.
It was designed for formal, contract-driven integration between organisations, and it adds optional standards on top, such as WS-Security for signing and encrypting messages. It is heavier than a typical JSON API, but still common in banking, insurance, government and older enterprise software.
Why it matters
Systems that use it tend to be old, important and rarely touched. They connect to payments, claims, identity or core records, and the people who built them may have moved on. A flaw there reaches data that matters.
Being old, they also carry old risks. XML parsers that load external entities, services that accept very large or deeply nested messages, and published WSDL files that map every operation can all appear. Buyers integrating with you may expect proof that these were checked.
How it shows up
You meet it when you integrate with a bank, a government portal or a legacy partner, and when you wrap an old system with a new front end. The service address often exposes its WSDL, which is useful to outsiders.
The mistakes repeat. The parser allows XXE. Operations are reachable without authentication. The SOAPAction value is trusted. Only part of a signed message is checked. Errors reveal stack traces. Check parser settings, authentication on each operation, message size limits and what the WSDL exposes.
Questions people ask
SOAP, answered
Is SOAP the same as REST?
No. SOAP is a strict messaging standard built on XML with a formal contract. REST is a looser style that usually uses JSON over plain HTTP methods.
Both are APIs, and both need the same security thinking.
Is SOAP secure?
It can be, because standards such as WS-Security support signing and encryption of messages. In practice, security depends on configuration, and old services are often set up loosely.
The usual API flaws apply too.
What is a WSDL file and is it a risk?
A WSDL file is a machine-readable description of a SOAP service. Publishing it helps legitimate developers, and it also gives an attacker a full list of operations.
Limit who can fetch it where you can.
Why is XXE linked to SOAP?
Because SOAP messages are XML, and an XML parser that resolves external entities can be made to read files or reach internal addresses. Turning that feature off in the parser is the standard fix.
See XXE for detail.
How do we test a SOAP service?
Start from the WSDL, call each operation with and without credentials, try other accounts' data, send malformed and oversized XML, and check error messages.
Many modern tools can import a WSDL for this.
Sources
Where this comes from
Related
Terms that sit next to this one
XXE
An XML parser tricked into fetching files or internal addresses.
API
The part of your application other software talks to, not a person.
REST API
A common web API style where URLs name things and HTTP verbs act on them.
Injection
Input that ends up running as a command instead of being read as text.
API schema validation
Rejecting requests that do not match the format the API says it accepts.
What does your old service still accept?
Older integrations are easy to leave out of testing. We find vulnerabilities in web apps and their APIs and prove each by exploiting it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.