# How to secure web services created by ActionWebService?

**URL:** <https://www.ruby-forum.com/t/how-to-secure-web-services-created-by-actionwebservice/56437>\
**Category:** Rails\
**Created:** [March 31, 2006, 6:34am UTC](https://www.ruby-forum.com/t/how-to-secure-web-services-created-by-actionwebservice/56437 "2006-03-31T06:34:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chang\_Sau\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c4cdca/32.png) [@Chang\_Sau\_S](https://www.ruby-forum.com/u/Chang_Sau_S)\
**Post date:** [March 31, 2006, 6:34am UTC](https://www.ruby-forum.com/t/how-to-secure-web-services-created-by-actionwebservice/56437/1 "2006-03-31T06:34:14Z")

</div>

Hi,

Does anyone know how I can go about securing web services created from  
ActionWebService? The manual from [rubyonrails.org](http://rubyonrails.org)  
([Peak Obsession](http://manuals.rubyonrails.com/read/book/10)) doesn’t say anything at  
all on this … or do I have to implement my own access control?

–  
Sau S.

[http://www.saush.com](http://www.saush.com)  
[http://read.saush.com](http://read.saush.com)  
[http://jaccal.sourceforge.net](http://jaccal.sourceforge.net)

---

<div class="post-metadata">

**Author:** ![Chang\_Sau\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c4cdca/32.png) [@Chang\_Sau\_S](https://www.ruby-forum.com/u/Chang_Sau_S)\
**Post date:** [March 31, 2006, 9:10am UTC](https://www.ruby-forum.com/t/how-to-secure-web-services-created-by-actionwebservice/56437/2 "2006-03-31T09:10:06Z")

</div>

Hi,

Chang Sau S. wrote:

> * * *
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

you can either use SSL to encrypt the data or a library like WSS4R  
([www.rubyforge.org/projects/wss4r](http://www.rubyforge.org/projects/wss4r)) that implements web service security  
mechanisms like signature and encryption as defined by the Oasis  
Consortium. WSS4R is tested with other WS-Security packages like WSE  
from MS (for .NET) or JWSDP from Sun (for Java).

Regards,  
Roland

---

<div class="post-metadata">

**Author:** ![Chang\_Sau\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c4cdca/32.png) [@Chang\_Sau\_S](https://www.ruby-forum.com/u/Chang_Sau_S)\
**Post date:** [April 1, 2006, 3:38am UTC](https://www.ruby-forum.com/t/how-to-secure-web-services-created-by-actionwebservice/56437/3 "2006-04-01T03:38:28Z")

</div>

Thks! I’ll take a look at the WSS4R library.

Roland S. wrote:

> > 
> 
> ([www.rubyforge.org/projects/wss4r](http://www.rubyforge.org/projects/wss4r)) that implements web service  
> security mechanisms like signature and encryption as defined by the  
> Oasis Consortium. WSS4R is tested with other WS-Security packages like  
> WSE from MS (for .NET) or JWSDP from Sun (for Java).
> 
> Regards,  
> Roland

–  
Sau S.

[http://www.saush.com](http://www.saush.com)  
[http://read.saush.com](http://read.saush.com)  
[http://jaccal.sourceforge.net](http://jaccal.sourceforge.net)