|
From: Ronald v. K. <rv...@ab...> - 2003-07-16 12:29:28
|
I don't think the sendig url is important. If security is needed, transport authentication should take place and to prevent spoofing, a transport authentication should be verified/checked against message-authentication (signature?) I'm working out such a mechanism (ldap based, but if it becomes a 'hook' other implementations (file based?) could be implemented as well). Ronald > -----Oorspronkelijk bericht----- > Van: Geilfuss, Brad [mailto:Bra...@Si...] > Verzonden: woensdag 16 juli 2003 1:38 > Aan: ebx...@li... > Onderwerp: [ebxmlms-general] spoofing to parties > > > Hi- > > One question, one heads up. > > The question: > > Is it possible to easily acertain the MSH that sent an ebxml > message aside from the <From><PartyId> element in the message > itself to confirm that the 'from' party hasn't been spoofed? > i.e., does the Request object ever get and store the URL of > the MSH that sent the message using Socket.getInetAddress() > or similar? This might be a useful feature otherwise. > > > The heads up: > > The call to onMessage() in > hk.hky.cecid.phoenix.message.handler.Request.run() (~line > 288) is wrapped in a blanket "catch" statement that doesn't > seem to report the errors it catches to any log. This makes > it arbitrarily hard to know if something has gone wrong in > any code that implements the MessageListener interface > because if an exception occurs that you don't explicitly > catch in your implementation of the interface, you'll never know it. > > B > > == > Brad Geilfuss > Sierra Systems > 400 N. Continental Blvd., Suite 300 > El Segundo, CA 90245 > www.SierraSystems.com > > > ------------------------------------------------------- > This SF.net email is sponsored by: VM Ware > With VMware you can run multiple operating systems on a > single machine. > WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual > machines at the > same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 > _______________________________________________ > ebxmlms-general mailing list > ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > |