Cybersecurity glossary
What is Simple Object Access Protocol (SOAP)?
Learn what SOAP is, how XML envelopes and WSDL define enterprise web services, how SOAP differs from REST, and which security standards and risks still matter.
Definition
Simple Object Access Protocol (SOAP) is an XML-based messaging protocol for exchanging structured information between applications—typically over HTTP—using envelopes, optional WSDL contracts, and a family of WS-* extensions for security, addressing, and reliability.
Why SOAP still matters
Before JSON APIs dominated, enterprises needed strict contracts, formal operations, and message-level security for partners who might not share the same stack. SOAP filled that niche with XML envelopes, WSDL, and a constellation of WS-* specifications.
Many critical billing, identity, and government integrations still speak SOAP. Security teams that only study REST will miss XML-specific attack classes on those channels.
SOAP message structure
Envelope
The required root wrapper that contains the SOAP message.
Header
Optional metadata for auth tokens, addressing, and routing extensions.
Body
The mandatory payload carrying the operation request or response data.
Fault
A standard way to return structured errors when processing fails.
How a SOAP call typically works
Publish or obtain a WSDL contract
Clients learn operations, types, and endpoints from the service description.
Generate or craft an XML request
Tooling builds an envelope with headers and a typed body.
Send over a transport (usually HTTPS)
POST carries the SOAP message to the service URL.
Server validates and dispatches
XML schema validation, WS-Security checks, then operation handlers run.
XML response or Fault returns
Clients deserialize into native types via stubs.
Extensions add enterprise features
WS-Addressing, reliable messaging, and policies appear in mature stacks.
SOAP vs REST (practical view)
| Topic | SOAP | Typical REST |
|---|---|---|
| Primary format | XML envelopes | JSON representations common |
| Contract | WSDL / XSD | OpenAPI / informal docs |
| Standards depth | Large WS-* ecosystem | HTTP semantics + optional profiles |
| Browser friendliness | Awkward for first-party web apps | Natural for web and mobile |
| Message security | WS-Security available | Mostly TLS + token headers |
Security priorities for SOAP services
Harden XML parsers
Disable external entities and DTDs; cap entity expansion and document size.
Prefer HTTPS always
TLS protects confidentiality even when WS-Security is also used.
Use WS-Security thoughtfully
Signatures and encrypted elements help with multi-hop trust—but increase complexity.
Authenticate and authorize operations
Treat each SOAP action like a privileged RPC; do not trust network location.
Keep stacks patched
Legacy SOAP libraries are frequent CVE sources in long-lived Java/.NET systems.
Limit WSDL exposure
Public WSDLs help attackers map operations—restrict where appropriate.
Operational checklist
- Inventory which partner and internal flows still depend on SOAP endpoints.
- Ensure XML parsers have XXE and billion-laughs protections enabled.
- Enforce schema validation and maximum message sizes.
- Require TLS 1.2+ and modern ciphers on SOAP HTTPS endpoints.
- Review WS-Security token types, key management, and replay protections.
- Monitor for unusual operation names and oversized XML payloads.
- Plan migration paths to REST/gRPC where business allows—without breaking compliance needs.
- Include SOAP routes in pentests and WAF XML inspection tests.
The practical takeaway
SOAP is an XML messaging protocol with strong enterprise contracts and optional message-level security. It is less common for new public APIs but remains deeply embedded in regulated and legacy integrations.
Secure SOAP by treating XML as hostile input, keeping stacks current, encrypting transport, and authorizing every operation. Ignore it only if you are sure none of your critical partners still speak it.
Related security terms
Representational State Transfer (REST)
The resource-oriented style that largely replaced SOAP for public HTTP APIs.
XML External Entity (XXE) Injection
A critical risk when SOAP stacks parse untrusted XML unsafely.
gRPC
A modern contract-first RPC alternative using Protobuf instead of XML envelopes.
Web Application Firewall (WAF)
May need XML-aware rules to inspect SOAP bodies effectively.
SSL/TLS
Transport security often combined with WS-Security message protections.
Frequently asked questions
What is SOAP in simple terms?
It is a formal way for programs to call each other using XML messages with a standard wrapper (the envelope), often with a published contract describing the operations.
Is SOAP still used?
Yes in many enterprises, banks, governments, and legacy integrations—even though new public APIs usually prefer REST or gRPC.
What is WSDL?
Web Services Description Language—an XML document that describes SOAP operations, messages, and bindings so clients can generate stubs.
How is SOAP different from REST?
SOAP is a protocol with XML envelopes and rich WS-* standards. REST is an architectural style typically using simpler HTTP resource APIs.
Does SOAP require HTTP?
HTTP(S) is the most common transport, but SOAP was designed to be transport-agnostic in principle.
What is WS-Security?
A standard for securing SOAP messages with signatures, encryption, and tokens at the message layer—beyond transport TLS alone.
What is the biggest SOAP security risk today?
Unsafe XML parsing (XXE, billion laughs), oversized payloads, and outdated stacks with known CVEs remain common.
References
Explore authoritative guidance and frameworks related to simple object access protocol (soap).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.