Hello,

In my Richui web application I 'm calling SOAP WS in an EGL Rich UI handler using @bindService property.

The application is running under J2EE security and uses form-based authentication.

But it seems that if a user is logged in, he is able to see the Web service call and the request parameters.

The user can change the request parameter(e.g. customer code (int)) easily and see different response results and not only the response that he is allowed to see.

How is it possible to secure this webservice call and prevent this WebService attack?

Thanks in advance.

Hello @michaeldefox

If I understand, can the user change the URL containing the customer ID? something like ? and submit browser submission for service access ?? it is ?

Osvaldo Menezes

@ojomenezes