Hi Mark,

Recently, I have new integration point to COSMOS application, is a port application using AS400. The COSMOS team give me this sample xml :

<?xml version="1.0" encoding="UTF-8" ?>

• <env:Envelope xmlns:env=“http://www.w3.org/2003/05/soap-envelope”>
• env:Header
• <cosmos:Controlrecord xmlns:cosmos=“http://www.cosmosworldwide.com”>
  cosmos:RQSTMDVAL</cosmos:RQST>
  cosmos:ACTNCRT</cosmos:ACTN>
  cosmos:RQIDunique request Id</cosmos:RQID>
  cosmos:RQLDIFS:AS400://system/QSYS.LIB/lib.LIB/dtaq.DTAQ</cosmos:RQLD>
  cosmos:QAIDrequesting application name</cosmos:QAID>
  cosmos:MORES</cosmos:MORE>
  cosmos:RTNMAS</cosmos:RTNM>
  cosmos:USIDuser</cosmos:USID>
  </cosmos:Controlrecord>
  </env:Header>
• env:Body
• <![CDATA[

<?xml version="1.0" encoding="UTF-8"?> DERRLT LINCAR MSK MSK ]]>

Frankly, i don’t know what kind of xml, is it SOAP RPC or Custom Document Literal.

Thank you

Fernand

#webMethods
#soa
#API-Management

It appears to be soap-rpc, but uses the very bad technique of stuffing the real payload into the single field called “data”. Also, the XML stuffed into the CDATA tag is not well formed. Perhaps that occured because you manually typed in the XML doc. There is no matching end tag for the element “Cosmos2Rqst”.

In short this is a very poor attempt to integrate using soap. If it is dictated by an application vendor you should give them lots of grief and refuse to pay maintenance. If this was created by an internal application team, send it back as unacceptable.

Mark

#API-Management
#webMethods
#soa

The use of CDATA to “hide” the body is also a naive practice. The body should either be HTML encoded or just placed in the body as is.

#webMethods
#soa
#API-Management

Actually the xml created by cosmosworldwide the port application vendor from Belgium. I will response to them about your analysis. Thank you very much.

Best Regards

Fernand

#API-Management
#webMethods
#soa

Mark,

I fail to understand why the above is a bad SOAP message. As I understand, all that the application is trying to do is wrap an XML payload into a SOAP body. However, I agree that the same result may be achieved by cleaning it up, by perhaps having the XML payload as an attachment.

However, in essence, I see it as a very valid SOAP message (not beautified though).

Cheers
G

#soa
#API-Management
#webMethods

Try validating the request against an XML schema with an invalid value in the cosmos:ACTN element. Was it detected?

Mark

#API-Management
#webMethods
#soa

I see your point now.

Cheers
G

#API-Management
#webMethods
#soa

Life gets even more complicated if you were to attempt to encrypt or digitally sign one or more elements inside the CDATA-enclosed XML string.

It’s not that the soap request was invalid per the soap spec, its just that it is non-standard, ignores best practices and reflects either a naive or lazy design.

Seriously, how much extra work would be required to avoid the CDATA if you were given that task? 30 minutes, a few days if you needed a generalized interface?

I get to see this kind of stuff frequently from web service newbies. That’s to be expected and there’s nothing wrong with that during a learning period (the web services equivalent of pink flashing fonts when learning HTML). However, when an application vendor produces this kind of, er, stuff and calls it web services or SOA, they should be soundly criticized and sent packing in embarrassment to get it right.

Great question, G. Hope that helps.

Regards,

Mark

#API-Management
#webMethods
#soa

Mark,

Thanks for the reply, clarifying most of my questions. The reason that I saw nothing wrong in the SOAP message, was because I was looking at it as a SOAP envelope.
However, I must admit I have done quite some wrapping of XML within a SOAP message myself. The message posted above reminded me of trying to force eBays’ web services (non SOAP based, previously) to a SOAP based client.
Well, we did not do the CDATA, as in the message posted, but we did use xsd:any extensively.
Yes, validation of the XMLs was quite a pain, but XSLT to get the desired XML response from eBay was quite helpful in validation.

Thanks again.

Cheers

G

#soa
#API-Management
#webMethods