Question

I have created an android application that calls (using kSOAP library) a SOAP based web service (developed in java, netbeans) over the intranet.

Now i want to make the application live, so this will require my web service to be exposed on the internet.

I have following questions…

1. How do i make sure that no one knows about the web service link except my android application
2. No one is able to call the web service except my android application
3. The data transferred between android application and web service is secure and encrypted
4. What kind of authentication mechanism should be used

I’m new to web services security so forgive me if my questions are dumb 🙂

Answer 1

1. This is impossible. Anyone having your app might use a traffic analyzer like wireshark and see all the requests it makes.
2. Sign each request you app makes(add some soap header) and check the signature on the server side
3. Use HTTPS
4. How to do authentication using SOAP?