REC-ws-addr-core-20060509.1 58.8 KB

Raw Blame History Permalink

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="en-US" xmlns="http://www.w3.org/1999/xhtml" xml:lang=
"en-US">
<head>
<meta name="generator" content=
"HTML Tidy for Linux/x86 (vers 1 September 2005), see www.w3.org" />
<meta http-equiv="Content-Type" content=
"text/html; charset=utf-8" />
<title>Web Services Addressing 1.0 - Core</title>

<style type="text/css">
/*<![CDATA[*/
code           { font-family: monospace; }

div.constraint,
div.issue,
div.note,
div.notice     { margin-left: 2em; }

dt.label       { display: run-in; }

li, p           { margin-top: 0.3em;
                 margin-bottom: 0.3em; }

.diff-chg       { background-color: yellow; }
.diff-del       { background-color: red; text-decoration: line-through;}
.diff-add       { background-color: lime; }

table          { empty-cells: show; }

table caption {
        font-weight: normal;
        font-style: italic;
        text-align: left;
        margin-bottom: .5em;
}

div.issue {
  color: red;
}

div.exampleInner pre { margin-left: 1em;
                       margin-top: 0em; margin-bottom: 0em}
div.exampleOuter {border: 4px double gray;
                  margin: 0em; padding: 0em}
div.exampleInner { background-color: #d5dee3;
                   border-top-width: 4px;
                   border-top-style: double;
                   border-top-color: #d3d3d3;
                   border-bottom-width: 4px;
                   border-bottom-style: double;
                   border-bottom-color: #d3d3d3;
                   padding: 4px; margin: 0em }
div.exampleWrapper { margin: 4px }
div.exampleHeader { font-weight: bold;
                    margin: 4px}
/*]]>*/
</style>
<link rel="stylesheet" type="text/css" href=
"http://www.w3.org/StyleSheets/TR/W3C-REC.css" />
<link rel="alternate" title="PDF" href="ws-addr-core.pdf" type=
"application/pdf" />
<link rel="alternate" title="PostScript" href="ws-addr-core.ps"
type="application/postscript" />
<link rel="alternate" title="XML" href="ws-addr-core.xml" type=
"text/xml" />
<link rel="alternate" title="plain text" href="ws-addr-core.txt"
type="text/plain" />
<link rel="contents" href="#contents" />
</head>
<body>
<div class="head">
<p><a href="http://www.w3.org/"><img src=
"http://www.w3.org/Icons/w3c_home" alt="W3C" height="48" width=
"72" /></a></p>
<h1>Web Services Addressing 1.0 - Core</h1>
<h2>W3C Recommendation 9 May 2006</h2>
<dl>
<dt>This version:</dt>
<dd><a href=
"http://www.w3.org/TR/2006/REC-ws-addr-core-20060509">http://www.w3.org/TR/2006/REC-ws-addr-core-20060509</a></dd>
<dt>Latest version:</dt>
<dd><a href=
"http://www.w3.org/TR/ws-addr-core">http://www.w3.org/TR/ws-addr-core</a></dd>
<dt>Previous versions:</dt>
<dd><a href=
"http://www.w3.org/TR/2006/PR-ws-addr-core-20060321">http://www.w3.org/TR/2006/PR-ws-addr-core-20060321</a></dd>
<dt>Editors:</dt>
<dd>Martin Gudgin, Microsoft Corp</dd>
<dd>Marc Hadley, Sun Microsystems, Inc</dd>
<dd>Tony Rogers, Computer Associates International, Inc</dd>
</dl>
<p>Please refer to the <a href=
"http://www.w3.org/2006/05/ws-addr-errata.html"><strong>errata</strong></a>
for this document, which may include some normative
corrections.</p>
<p>This document is also available in these non-normative formats:
<a href="ws-addr-core.pdf">PDF</a>, <a href=
"ws-addr-core.ps">PostScript</a>, <a href=
"ws-addr-core.xml">XML</a>, and&nbsp;<a href=
"ws-addr-core.txt">plain text</a>.</p>
<p>See also <a href=
"http://www.w3.org/2003/03/Translations/byTechnology?technology=ws-addr-core">
<strong>translations</strong></a>.</p>
<p class="copyright"><a href=
"http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a>&nbsp;©&nbsp;2006&nbsp;<a href="http://www.w3.org/"><acronym title="World Wide Web Consortium">W3C</acronym></a><sup>®</sup>
(<a href="http://www.csail.mit.edu/"><acronym title=
"Massachusetts Institute of Technology">MIT</acronym></a>, <a href=
"http://www.ercim.org/"><acronym title=
"European Research Consortium for Informatics and Mathematics">ERCIM</acronym></a>,
<a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved.
W3C <a href=
"http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>,
<a href=
"http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a>
and <a href=
"http://www.w3.org/Consortium/Legal/copyright-documents">document
use</a> rules apply.</p>
</div>
<hr />
<div>
<h2><a name="abstract" id="abstract">Abstract</a></h2>
<p>Web Services Addressing provides transport-neutral mechanisms to
address Web services and messages. Web Services Addressing 1.0 -
Core (this document) defines a set of abstract properties and an
XML Infoset [<cite><a href="#XMLInfoSet">XML Information
Set</a></cite>] representation thereof to reference Web services
and to facilitate end-to-end addressing of endpoints in messages.
This specification enables messaging systems to support message
transmission through networks that include processing nodes such as
endpoint managers, firewalls, and gateways in a transport-neutral
manner.</p>
</div>
<div>
<h2><a name="status" id="status">Status of this Document</a></h2>
<p><em>This section describes the status of this document at the
time of its publication. Other documents may supersede this
document. A list of current W3C publications and the latest
revision of this technical report can be found in the <a href=
"http://www.w3.org/TR/">W3C technical reports index</a> at
http://www.w3.org/TR/.</em></p>
<p>This is the <a href=
"http://www.w3.org/2005/10/Process-20051014/tr.html#RecsW3C">Recommendation</a>
of the Web Services Addressing 1.0 - Core specification. It has
been produced by the <a href="http://www.w3.org/2002/ws/addr/">Web
Services Addressing Working Group</a> (WG), which is part of the
<a href="http://www.w3.org/2002/ws/Activity">W3C Web Services
Activity</a>.</p>
<p>This document has been reviewed by W3C Members, by software
developers, and by other W3C groups and interested parties, and is
endorsed by the Director as a W3C Recommendation. It is a stable
document and may be used as reference material or cited from
another document. W3C's role in making the Recommendation is to
draw attention to the specification and to promote its widespread
deployment. This enhances the functionality and interoperability of
the Web.</p>
<p>The Working Group made the following editorial changes to the
Proposed Recommendation in response to comments: normative and
informative references are now more clearly distinguished, and some
typographical errors were fixed. An <a href=
"http://www.w3.org/2002/ws/addr/5/08/impl-report/">implementation
report</a> showing that the Candidate Recommendation exit criteria
have been met and exceeded is available, along with a <a href=
"http://www.w3.org/2002/ws/addr/testsuite/">test suite</a>. A
<a href="diff.html">diff-marked version against the previous
version of this document</a> is available.</p>
<p>Please report errors in this document to the public <a href=
"mailto:public-ws-addressing-comments@w3.org">public-ws-addressing-comments@w3.org</a>
mailing list (<a href=
"http://lists.w3.org/Archives/Public/public-ws-addressing-comments/">public
archive</a>).</p>
<p>This document was produced by a group operating under the
<a href="http://www.w3.org/Consortium/Patent-Policy-20040205/">5
February 2004 W3C Patent Policy</a>. W3C maintains a <a href=
"http://www.w3.org/2004/01/pp-impl/36696/status#specs">public list
of any patent disclosures</a> made in connection with the
deliverables of the group; that page also includes instructions for
disclosing a patent. An individual who has actual knowledge of a
patent which the individual believes contains <a href=
"http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">
Essential Claim(s)</a> must disclose the information in accordance
with <a href=
"http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">
section 6 of the W3C Patent Policy</a>.</p>
</div>
<hr />
<div class="toc">
<h2><a name="contents" id="contents">Table of Contents</a></h2>
<p class="toc">1. <a href="#tocRange">Introduction</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;1.1 <a href="#notation">Notational
Conventions</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;1.2 <a href=
"#namespaces">Namespaces</a><br />
2. <a href="#eprs">Endpoint References</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.1 <a href="#eprinfomodel">Information
Model for Endpoint References</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.2 <a href="#eprinfoset">Endpoint
Reference XML Infoset Representation</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.3 <a href="#eprcomp">Endpoint Reference
Comparison</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.4 <a href="#eprlifecycle">Endpoint
Reference Lifecycle</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.5 <a href="#eprextensibility">Endpoint
Reference Extensibility</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;2.6 <a href=
"#resourceidentification">Identifying Resources in an Endpoint
Reference</a><br />
3. <a href="#msgaddrprops">Message Addressing Properties</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;3.1 <a href="#abstractmaps">Abstract
Property Definitions</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;3.2 <a href="#msgaddrpropsinfoset">XML
Infoset Representation of Message Addressing Properties</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3.2.1 <a href=
"#compiri">Comparing IRIs</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;3.3 <a href="#sendmsgepr">Sending a Message
to an EPR</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;3.4 <a href="#formreplymsg">Formulating a
Reply Message</a><br />
4. <a href="#securityconsiderations">Security
Considerations</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;4.1 <a href="#id2270741">Additional
Security Considerations</a><br />
5. <a href="#references">References</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;5.1 <a href=
"#Normative-References">Normative References</a><br />
&nbsp;&nbsp;&nbsp;&nbsp;5.2 <a href="#Informative-References">Other
References</a><br /></p>
<h3><a name="appendix" id="appendix">Appendix</a></h3>
<p class="toc">A. <a href="#acknowledgments">Acknowledgements</a>
(Non-Normative)<br /></p>
</div>
<hr />
<div class="body">
<div class="div1">
<h2><a name="tocRange" id="tocRange"></a>1. Introduction</h2>
<p>Web Services Addressing 1.0 - Core (WS-Addressing) defines two
constructs, message addressing properties and endpoint references,
that normalize the information typically provided by transport
protocols and messaging systems in a way that is independent of any
particular transport or messaging system.</p>
<p>A Web service endpoint is a (referenceable) entity, processor,
or resource to which Web service messages can be addressed.
Endpoint references convey the information needed to address a Web
service endpoint. Note that WSDL 2.0 has an Endpoint component
[<cite><a href="#WSDL20">WSDL 2.0 Core Language</a></cite>, Section
2.15 Endpoint] which along with other WSDL 2.0 components can be
used to describe a Web service endpoint. A Web service endpoint may
in fact have multiple such descriptions. Similarly, multiple
endpoint references (EPRs) can be used to convey information needed
to address a particular Web service endpoint. An EPR is intended to
convey information required to address a Web service endpoint
whereas a WSDL 2.0 description is intended to describe a Web
service.</p>
<p>This specification defines a family of message addressing
properties that convey end-to-end message characteristics including
references for source and destination endpoints and message
identity that allows uniform addressing of messages independent of
the underlying transport.</p>
<p>Both of these constructs are designed to be extensible and
re-usable so that other specifications can build on and leverage
endpoint references and message addressing properties.</p>
<p>The following example illustrates the use of these mechanisms in
a SOAP 1.2 message being sent from
http://example.com/business/client1 to
http://example.com/fabrikam/Purchasing (see Web Services Addressing
1.0 - SOAP Binding[<cite><a href="#WSADDR-SOAP">WS-Addressing SOAP
Binding</a></cite>] for more information on the use of
WS-Addressing in SOAP):</p>
<div class="exampleOuter">
<p style="text-align: left" class="exampleHead"><i><span>Example
1-1.</span> Use of message addressing properties in a SOAP 1.2
message.</i></p>
<div class="exampleInner">
<pre>
(01) &lt;S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope"
                xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
(02)   &lt;S:Header&gt;
(03)    &lt;wsa:MessageID&gt;http://example.com/6B29FC40-CA47-1067-B31D-00DD010662DA&lt;/wsa:MessageID&gt;
(04)    &lt;wsa:ReplyTo&gt;
(05)      &lt;wsa:Address&gt;http://example.com/business/client1&lt;/wsa:Address&gt;
(06)    &lt;/wsa:ReplyTo&gt;
(07)    &lt;wsa:To&gt;http://example.com/fabrikam/Purchasing&lt;/wsa:To&gt;
(08)    &lt;wsa:Action&gt;http://example.com/fabrikam/SubmitPO&lt;/wsa:Action&gt;
(09)   &lt;/S:Header&gt;
(10)   &lt;S:Body&gt;
(11)     ...
(12)   &lt;/S:Body&gt;
(13) &lt;/S:Envelope&gt;
</pre></div>
<p>Lines (02) to (09) represent the header of the SOAP message
where the mechanisms defined in the specification are used. The
body is represented by lines (10) to (12).</p>
<p>Lines (03) to (08) contain the message addressing header blocks.
Specifically, line (02) specifies the identifier for this message
and lines (04) to (06) specify the endpoint to which replies to
this message should be sent as an endpoint reference. Line (07)
specifies the address URI of the ultimate receiver of this message.
Line (08) specifies an action URI identifying expected
semantics.</p>
</div>
<div class="div2">
<h3><a name="notation" id="notation"></a>1.1 Notational
Conventions</h3>
<p>The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in RFC 2119
[<cite><a href="#RFC2119">IETF RFC 2119</a></cite>].</p>
<p>When describing abstract data models, this specification uses
the notational convention used by the XML Infoset [<cite><a href=
"#XMLInfoSet">XML Information Set</a></cite>]. Specifically,
abstract property names always appear in square brackets (e.g.,
[some property]).</p>
<p>When describing concrete XML schemas [<cite><a href=
"#XMLSchemaP1">XML Schema Structures</a></cite>, <cite><a href=
"#XMLSchemaP2">XML Schema Datatypes</a></cite>], this specification
uses the notational convention of WS-Security [<cite><a href=
"#WS-Security">WS-Security 2004</a></cite>]. Specifically, each
member of an Element Information Item's [children] or [attributes]
property is described using an XPath-like notation (e.g.,
/x:MyHeader/x:SomeProperty/@value1). The use of {any} indicates the
presence of an element wildcard (&lt;xs:any/&gt;). The use of
@{any} indicates the presence of an attribute wildcard
(&lt;xs:anyAttribute/&gt;).</p>
<p>Where pseudo-schemas are provided for a component, they use
BNF-style conventions for attributes and elements: "?" denotes
optionality (i.e. zero or one occurrences), "*" denotes zero or
more occurrences, "+" one or more occurrences, "[" and "]" are used
to form groups, and "|" represents choice. Attributes are
conventionally assigned a value which corresponds to their type, as
defined in the normative schema. Elements with simple content are
conventionally assigned a value which corresponds to the type of
their content, as defined in the normative schema. Pseudo schemas
do not include extensibility points for brevity.</p>
<p>When defining the cardinality of endpoint reference properties
and message addressing properties, this specification uses the
following notation: (<i>n</i>..<i>m</i>), where <i>n</i> is the
minimum allowed number of occurrences of the property and <i>m</i>
is the maximum allowed number of occurrences. When <i>n</i> has the
same value as <i>m</i> then exactly that number of occurrences of
the property must be present in the associated endpoint reference
or message.</p>
</div>
<div class="div2">
<h3><a name="namespaces" id="namespaces"></a>1.2 Namespaces</h3>
<p>This specification uses a number of namespace prefixes
throughout; they are listed in <a href="#nsprefix">Table 1-1</a>.
Note that the choice of any namespace prefix is arbitrary and not
semantically significant (see [<cite><a href="#XMLNS">XML
Namespaces</a></cite>]).</p>
<a name="nsprefix" id="nsprefix"></a>
<table summary="Namespace prefixes usage in this specification"
border="1">
<caption>Table 1-1. Prefixes and Namespaces used in this
specification</caption>
<tbody>
<tr>
<th align="left" rowspan="1" colspan="1">Prefix</th>
<th align="left" rowspan="1" colspan="1">Namespace</th>
</tr>
<tr>
<td rowspan="1" colspan="1">wsa</td>
<td rowspan="1" colspan="1">
http://www.w3.org/2005/08/addressing</td>
</tr>
<tr>
<td rowspan="1" colspan="1">S</td>
<td rowspan="1" colspan="1">
http://www.w3.org/2003/05/soap-envelope</td>
</tr>
<tr>
<td rowspan="1" colspan="1">xs</td>
<td rowspan="1" colspan="1">http://www.w3.org/2001/XMLSchema</td>
</tr>
</tbody>
</table>
<br />
<p>WS-Addressing may be used with SOAP [<cite><a href=
"#SOAP12-PART1">SOAP 1.2 Messaging Framework</a></cite>,
<cite><a href="#SOAP11">SOAP 1.1</a></cite>] as described in Web
Services Addressing 1.0 - SOAP Binding[<cite><a href=
"#WSADDR-SOAP">WS-Addressing SOAP Binding</a></cite>].
WS-Addressing may be used with WSDL [<cite><a href="#WSDL20">WSDL
2.0 Core Language</a></cite>, <cite><a href="#WSDL11">WSDL
1.1</a></cite>] described services as described in Web Services
Addressing 1.0 - WSDL Binding[<cite><a href=
"#WSADDR-WSDL">WS-Addressing WSDL Binding</a></cite>]. Examples in
this specification use an XML 1.0 [<cite><a href="#XML10">XML
1.0</a></cite>] representation but this is not a requirement.</p>
<p>All information items defined by this specification are
identified by the XML namespace URI [<cite><a href="#XMLNS">XML
Namespaces</a></cite>] <a href=
"http://www.w3.org/2005/08/addressing">http://www.w3.org/2005/08/addressing</a>.
A normative XML Schema [<cite><a href="#XMLSchemaP1">XML Schema
Structures</a></cite>, <cite><a href="#XMLSchemaP2">XML Schema
Datatypes</a></cite>] document can be obtained by dereferencing the
XML namespace URI.</p>
</div>
</div>
<div class="div1">
<h2><a name="eprs" id="eprs"></a>2. Endpoint References</h2>
<p>This section defines the information model and syntax of an
endpoint reference.</p>
<p>This specification introduces the endpoint reference, a
construct designed to support the following usage scenarios:</p>
<ul>
<li>
<p>Dynamic generation and customization of service endpoint
descriptions.</p>
</li>
</ul>
<ul>
<li>
<p>Referencing and description of specific service instances that
are created as the result of stateful interactions.</p>
</li>
</ul>
<ul>
<li>
<p>Flexible and dynamic exchange of endpoint information in tightly
coupled environments where communicating parties share a set of
common assumptions about specific policies or protocols that are
used during the interaction.</p>
</li>
</ul>
<div class="div2">
<h3><a name="eprinfomodel" id="eprinfomodel"></a>2.1 Information
Model for Endpoint References</h3>
<p>An endpoint reference is a collection of abstract properties.
This specification defines a core set of properties, but it is also
possible for other specifications to extend these and/or add other
properties. The semantics and XML Infoset representation for any
such extension properties will be described in their defining
specifications. An endpoint reference consists of the following
abstract properties:</p>
<dl>
<dt class="label">[address] : IRI (1..1)</dt>
<dd>
<p>An absolute IRI [<cite><a href="#RFC3987">IETF RFC
3987</a></cite>] representing the address of the endpoint. This
specification introduces two predefined [address] values as shown
in <a href="#predefaddr">Table 2-1</a>.</p>
<a name="predefaddr" id="predefaddr"></a>
<table border="1" summary="Predefined [address] values">
<caption>Table 2-1. Predefined [address] values</caption>
<tbody>
<tr>
<th align="left" rowspan="1" colspan="1">URI</th>
<th align="left" rowspan="1" colspan="1">Description</th>
</tr>
<tr>
<td rowspan="1" colspan="1">
"http://www.w3.org/2005/08/addressing/anonymous"</td>
<td rowspan="1" colspan="1">Some endpoints cannot be located with a
meaningful IRI; this URI is used to allow such endpoints to send
and receive messages. The precise meaning of this URI is defined by
the binding of Addressing to a specific protocol and/or the context
in which the EPR is used.</td>
</tr>
<tr>
<td rowspan="1" colspan="1">
"http://www.w3.org/2005/08/addressing/none"</td>
<td rowspan="1" colspan="1">Messages sent to EPRs whose [address]
is this value MUST be discarded (i.e. not sent). This URI is
typically used in EPRs that designate a reply or fault endpoint
(see section <a href="#abstractmaps"><b>3.1 Abstract Property
Definitions</b></a>) to indicate that no reply or fault message
should be sent.</td>
</tr>
</tbody>
</table>
<br /></dd>
<dt class="label">[reference parameters] : xs:any
(0..unbounded).</dt>
<dd>
<p>A reference may contain a number of individual parameters that
are associated with the endpoint to facilitate a particular
interaction. Reference parameters are namespace-qualified element
information items that are required to properly interact with the
endpoint. Reference parameters are provided by the issuer of the
endpoint reference and are assumed to be opaque to other users of
an endpoint reference. The binding of reference parameters to
messages depends upon the protocol binding used to interact with
the endpoint - Web Services Addressing 1.0 - SOAP
Binding[<cite><a href="#WSADDR-SOAP">WS-Addressing SOAP
Binding</a></cite>] describes the default binding for the SOAP
protocol.</p>
<p>The reference parameters are not ordered. No significance can be
attributed to any order in which they may appear, because they may
be bound to a message in a way which does not preserve that
ordering.</p>
</dd>
<dt class="label">[metadata] : xs:any (0..unbounded)</dt>
<dd>
<p>A reference may contain metadata that describes the behavior,
policies and capabilities of the endpoint. Metadata may be included
in an endpoint reference to facilitate easier processing by a user
of an endpoint reference, or because the metadata was dynamically
generated.</p>
<p>The metadata embedded in an EPR is not necessarily a complete
statement of the metadata pertaining to the endpoint. Moreover,
while embedded metadata is necessarily valid at the time the EPR is
initially created it may become stale at a later point in time.</p>
<p>To deal with conflicts between the embedded metadata of two EPRs
that have the same [address], or between embedded metadata and
metadata obtained from a different source, or to ascertain the
current validity of embedded metadata, mechanisms that are outside
of the scope of this specification, such as EPR life cycle
information (see <a href="#eprlifecycle"><b>2.4 Endpoint Reference
Lifecycle</b></a>) or retrieval of metadata from an authoritative
source, SHOULD be used.</p>
</dd>
</dl>
</div>
<div class="div2">
<h3><a name="eprinfoset" id="eprinfoset"></a>2.2 Endpoint Reference
XML Infoset Representation</h3>
<p>This section defines an XML Infoset-based representation for an
endpoint reference as both an XML type (wsa:EndpointReferenceType)
and as an XML element (&lt;wsa:EndpointReference&gt;). For brevity
simple XML terms are used, e.g. 'element' instead of 'element
information item' - this is not intended to constrain use of the
constructs defined in this section to textual XML
representations.</p>
<p>The wsa:EndpointReferenceType type is used wherever a Web
service endpoint is referenced. The following describes the
contents of this type:</p>
<div class="exampleInner">
<pre>
&lt;<b>wsa:EndpointReference</b>&gt;
    &lt;wsa:Address&gt;<i>xs:anyURI</i>&lt;/wsa:Address&gt;
    &lt;wsa:ReferenceParameters&gt;<i>xs:any</i>*&lt;/wsa:ReferenceParameters&gt; ?
    &lt;wsa:Metadata&gt;<i>xs:any</i>*&lt;/wsa:Metadata&gt;?
&lt;/<b>wsa:EndpointReference</b>&gt;
</pre></div>
<p>The following describes the attributes and elements listed in
the schema overview above:</p>
<dl>
<dt class="label">/wsa:EndpointReference</dt>
<dd>
<p>This represents some element of type wsa:EndpointReferenceType.
This example uses the predefined &lt;wsa:EndpointReference&gt;
element, but any element of type wsa:EndpointReferenceType may be
used.</p>
</dd>
<dt class="label">/wsa:EndpointReference/wsa:Address</dt>
<dd>
<p>This REQUIRED element (whose content is of type xs:anyURI)
specifies the [address] property of the endpoint reference.</p>
</dd>
<dt class="label">/wsa:EndpointReference/wsa:Address/@{any}</dt>
<dd>
<p>This is an extensibility mechanism to allow additional
attributes to be specified.</p>
</dd>
<dt class="label">
/wsa:EndpointReference/wsa:ReferenceParameters</dt>
<dd>
<p>This OPTIONAL element may contain elements from any namespace.
Such elements form the [reference parameters] of the reference.</p>
</dd>
<dt class="label">
/wsa:EndpointReference/wsa:ReferenceParameters/@{any}</dt>
<dd>
<p>This is an extensibility mechanism to allow additional
attributes to be specified.</p>
</dd>
<dt class="label">
/wsa:EndpointReference/wsa:ReferenceParameters/{any}</dt>
<dd>
<p>Each element information item found in [reference parameters]
(including all of that elements [children], [attributes] and
[in-scope namespaces]) is represented as is.</p>
</dd>
<dt class="label">/wsa:EndpointReference/wsa:Metadata</dt>
<dd>
<p>This OPTIONAL element may contain elements from any namespace.
Such elements form the metadata that is relevant to the interaction
with the endpoint.</p>
</dd>
<dt class="label">/wsa:EndpointReference/wsa:Metadata/{any}</dt>
<dd>
<p>Each child element of Metadata represents an individual piece of
metadata.</p>
</dd>
<dt class="label">/wsa:EndpointReference/wsa:Metadata/{@any}</dt>
<dd>
<p>This is an extensibility mechanism to allow additional
attributes to be specified. Some examples in this specification
show use of this extensibility point to include a
wsdlLocation[<cite><a href="#WSDL20">WSDL 2.0 Core
Language</a></cite>] attribute to provide a hint for the location
of a WSDL description of the service deployed at the endpoint.</p>
</dd>
<dt class="label">/wsa:EndpointReference/{any}</dt>
<dd>
<p>This is an extensibility mechanism to allow additional elements
to be specified.</p>
</dd>
<dt class="label">/wsa:EndpointReference/@{any}</dt>
<dd>
<p>This is an extensibility mechanism to allow additional
attributes to be specified.</p>
</dd>
</dl>
<div class="note">
<p class="prefix"><b>Note:</b></p>
<p>Specifications which describe any extension elements or
attributes used to augment the above model will explain any effects
those extensions may have on the abstract properties. They may
affect either the core properties or extension properties as
defined in <a href="#eprinfomodel"><b>2.1 Information Model for
Endpoint References</b></a>.</p>
</div>
<p>The following shows an example endpoint reference. This element
references the the endpoint at the URI
"http://example.com/fabrikam/acct".</p>
<div class="exampleOuter">
<p style="text-align: left" class="exampleHead"><i><span>Example
2-1.</span> Example endpoint reference.</i></p>
<div class="exampleInner">
<pre>
&lt;wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
   &lt;wsa:Address&gt;http://example.com/fabrikam/acct&lt;/wsa:Address&gt;
&lt;/wsa:EndpointReference&gt;

</pre></div>
</div>
</div>
<div class="div2">
<h3><a name="eprcomp" id="eprcomp"></a>2.3 Endpoint Reference
Comparison</h3>
<p>This specification provides no concept of endpoint identity and
therefore does not provide any mechanism to determine equality or
inequality of EPRs and does not specify the consequences of their
equality or inequality. However, note that it is possible for other
specifications to provide a comparison function that is applicable
within a limited scope.</p>
</div>
<div class="div2">
<h3><a name="eprlifecycle" id="eprlifecycle"></a>2.4 Endpoint
Reference Lifecycle</h3>
<p>This specification does not define a lifecycle model for
endpoint references and does not address the question of
time-to-live for endpoint references. Other specifications that
build on or use WS-Addressing may define a lifecycle model for
endpoint references created according to that specification.</p>
</div>
<div class="div2">
<h3><a name="eprextensibility" id="eprextensibility"></a>2.5
Endpoint Reference Extensibility</h3>
<p>As noted in <a href="#eprinfoset"><b>2.2 Endpoint Reference XML
Infoset Representation</b></a> endpoint references are extensible.
When extension attributes or elements appear as part of an endpoint
reference, the processing model for such extensions is defined by
the specification for those extensions. Software that processes
endpoint references can safely ignore any such extensions that it
does not recognize or understand.</p>
<p>Extension elements and attributes MAY add additional properties
to an endpoint reference in addition to those specified in <a href=
"#eprinfomodel"><b>2.1 Information Model for Endpoint
References</b></a>. Endpoint reference extensions MAY modify the
value of one or more existing properties of an endpoint reference.
Extensions MAY modify the rules for binding endpoint reference
properties to message addressing properties, or otherwise indicate
that a different binding be used.</p>
<p>Note that this ability to modify existing properties and binding
behavior, when coupled with the fact that software can ignore
unknown or unrecognized extensions, may result in a difference in
behavior depending on whether such an extended endpoint reference
is processed by software that understands the extension(s). When
designing endpoint reference extensions designers should consider
that standard processing per this specification will prevail in
cases where their extension is not recognized or understood.</p>
</div>
<div class="div2">
<h3><a name="resourceidentification" id=
"resourceidentification"></a>2.6 Identifying Resources in an
Endpoint Reference</h3>
<p>The Architecture of the World Wide Web, Volume One
[<cite><a href="#AoWWW">AoWWW</a></cite>] recommends
[<cite><a href="#AoWWW">AoWWW</a></cite>, Section 2] the use of
URIs to identify resources. Using abstract properties of an EPR
other than [destination] to identify resources is contrary to this
recommendation. In certain circumstances, such a use of additional
properties may be convenient or beneficial; however, when building
systems, the benefits or convenience of identifying a resource
using reference parameters should be carefully weighed against the
benefits of identifying a resource solely by URI as explained in
[<cite><a href="#AoWWW">AoWWW</a></cite>, Section 2.1] of the Web
Architecture.</p>
</div>
</div>
<div class="div1">
<h2><a name="msgaddrprops" id="msgaddrprops"></a>3. Message
Addressing Properties</h2>
<p>This section defines the information model and syntax of message
addressing properties.</p>
<p>Message addressing properties provide references for the
endpoints involved in an interaction. The use of these properties
to support specific interactions is in general defined by both the
semantics of the properties themselves and the implicit or explicit
contract that governs the message exchange. If explicitly
available, this contract can take different forms including but not
being limited to WSDL MEPs and interfaces; business processes and
e-commerce specifications, among others, can also be used to define
explicit contracts between the parties.</p>
<p>In a one-way interaction pattern a source sends a message to a
destination without any further definition of the interaction.
"Request-response" is a common interaction pattern that consists of
an initial message sent by a source endpoint (the request) and a
subsequent message sent from the destination of the request back to
the source (the response). A response in this case can be either an
application message, a fault, or any other message. Note, however,
that reply messages may be sent as part of other message exchanges
as well, and are not restricted to the usual single Request, single
Response pattern, or to a particular WSDL transmission primitive or
MEP. The contract between the interacting parties may specify that
multiple or even a variable number of replies be delivered.</p>
<p>The set of message addressing properties defined in this
specification is sufficient for many simple variations of one-way
and request-response MEPs. More advanced MEPs may require
additional message addressing properties to augment the facilities
provided here.</p>
<div class="div2">
<h3><a name="abstractmaps" id="abstractmaps"></a>3.1 Abstract
Property Definitions</h3>
<p>Message addressing properties collectively augment a message
with the following abstract properties to support one-way,
request-response, and other interaction patterns:</p>
<dl>
<dt class="label">[destination] : IRI (1..1)</dt>
<dd>
<p>An absolute IRI representing the address of the intended
receiver of this message.</p>
</dd>
<dt class="label">[source endpoint] : endpoint reference
(0..1)</dt>
<dd>
<p>Reference to the endpoint from which the message originated.</p>
</dd>
<dt class="label">[reply endpoint] : endpoint reference (0..1)</dt>
<dd>
<p>An endpoint reference for the intended receiver for replies to
this message.</p>
</dd>
<dt class="label">[fault endpoint] : endpoint reference (0..1)</dt>
<dd>
<p>An endpoint reference for the intended receiver for faults
related to this message.</p>
</dd>
<dt class="label">[action] : IRI (1..1)</dt>
<dd>
<p>An absolute IRI that uniquely identifies the semantics implied
by this message.</p>
<p>It is RECOMMENDED that the value of the [action] property is an
IRI identifying an input, output, or fault message within a WSDL
interface or port type. An action may be explicitly or implicitly
associated with the corresponding WSDL definition. Web Services
Addressing 1.0 - WSDL Binding[<cite><a href=
"#WSADDR-WSDL">WS-Addressing WSDL Binding</a></cite>] describes the
mechanisms of association.</p>
</dd>
<dt class="label">[message id] : IRI (0..1)</dt>
<dd>
<p>An absolute IRI that uniquely identifies the message. When
present, it is the responsibility of the sender to ensure that each
message is uniquely identified. The behavior of a receiver when
receiving a message that contains the same [message id] as a
previously received message is unconstrained by this
specification.</p>
</dd>
<dt class="label">[relationship] : (IRI, IRI) (0..unbounded)</dt>
<dd>
<p>A pair of values that indicate how this message relates to
another message. The type of the relationship is identified by an
absolute IRI. The related message is identified by an absolute IRI
that corresponds to the related message's [message id] property.
The message identifier IRI may refer to a specific message, or be
the following pre-defined URI that means "unspecified message":
"http://www.w3.org/2005/08/addressing/unspecified"</p>
<p>This specification has one predefined relationship type as shown
in <a href="#predefrels">Table 3-1</a>.</p>
<a name="predefrels" id="predefrels"></a>
<table border="1" summary="Predefined [relationship] type values">
<caption>Table 3-1. Predefined [relationship] values</caption>
<tbody>
<tr>
<th align="left" rowspan="1" colspan="1">URI</th>
<th align="left" rowspan="1" colspan="1">Description</th>
</tr>
<tr>
<td rowspan="1" colspan="1">
"http://www.w3.org/2005/08/addressing/reply"</td>
<td rowspan="1" colspan="1">Indicates that this is a reply to the
message identified by the [message id] IRI.</td>
</tr>
</tbody>
</table>
<br /></dd>
<dt class="label">[reference parameters] : xs:any
(0..unbounded).</dt>
<dd>
<p>Corresponds to the value of the [reference parameters] property
of the endpoint reference to which the message is addressed.</p>
</dd>
</dl>
<p>The [destination] and [action] properties indicate the target
processing location and the verb or intent of the message
respectively. The values of these properties can be used to
facilitate the dispatch of messages.</p>
<p>A binding of WS-Addressing message addressing properties MUST
reflect the property cardinality shown above. Web Services
Addressing 1.0 - SOAP Binding[<cite><a href=
"#WSADDR-SOAP">WS-Addressing SOAP Binding</a></cite>] defines such
a binding for the SOAP [<cite><a href="#SOAP12-PART1">SOAP 1.2
Messaging Framework</a></cite>, <cite><a href="#SOAP11">SOAP
1.1</a></cite>] protocol.</p>
</div>
<div class="div2">
<h3><a name="msgaddrpropsinfoset" id="msgaddrpropsinfoset"></a>3.2
XML Infoset Representation of Message Addressing Properties</h3>
<p>The following shows the XML Infoset representation of the
message addressing properties defined in <a href=
"#abstractmaps"><b>3.1 Abstract Property Definitions</b></a>:</p>
<div class="exampleInner">
<pre>
&lt;<b>wsa:To</b>&gt;<i>xs:anyURI</i>&lt;/<b>wsa:To</b>&gt; ?
&lt;<b>wsa:From</b>&gt;<i>wsa:EndpointReferenceType</i>&lt;/<b>wsa:From</b>&gt; ?
&lt;<b>wsa:ReplyTo</b>&gt;<i>wsa:EndpointReferenceType</i>&lt;/<b>wsa:ReplyTo</b>&gt; ?
&lt;<b>wsa:FaultTo</b>&gt;<i>wsa:EndpointReferenceType</i>&lt;/<b>wsa:FaultTo</b>&gt; ?
&lt;<b>wsa:Action</b>&gt;<i>xs:anyURI</i>&lt;/<b>wsa:Action</b>&gt;
&lt;<b>wsa:MessageID</b>&gt;<i>xs:anyURI</i>&lt;/<b>wsa:MessageID</b>&gt; ?
&lt;<b>wsa:RelatesTo</b> RelationshipType="<i>xs:anyURI</i>"?&gt;<i>xs:anyURI</i>&lt;/<b>wsa:RelatesTo</b>&gt; *
&lt;<b>wsa:ReferenceParameters</b>&gt;<i>xs:any</i>*&lt;/<b>wsa:ReferenceParameters</b>&gt; ?

</pre></div>
<p>The following describes the attributes and elements listed in
the schema overview above:</p>
<dl>
<dt class="label">/wsa:To</dt>
<dd>
<p>This OPTIONAL element (whose content is of type xs:anyURI)
provides the value for the [destination] property. If this element
is NOT present then the value of the [destination] property is
"http://www.w3.org/2005/08/addressing/anonymous".</p>
</dd>
<dt class="label">/wsa:From</dt>
<dd>
<p>This OPTIONAL element (of type wsa:EndpointReferenceType)
provides the value for the [source endpoint] property.</p>
</dd>
<dt class="label">/wsa:ReplyTo</dt>
<dd>
<p>This OPTIONAL element (of type wsa:EndpointReferenceType)
provides the value for the [reply endpoint] property. If this
element is NOT present then the value of the [address] property of
the [reply endpoint] EPR is
"http://www.w3.org/2005/08/addressing/anonymous".</p>
</dd>
<dt class="label">/wsa:FaultTo</dt>
<dd>
<p>This OPTIONAL element (of type wsa:EndpointReferenceType)
provides the value for the [fault endpoint] property.</p>
</dd>
<dt class="label">/wsa:Action</dt>
<dd>
<p>This REQUIRED element (whose content is of type xs:anyURI)
conveys the value of the [action] property.</p>
</dd>
<dt class="label">/wsa:MessageID</dt>
<dd>
<p>This OPTIONAL element (whose content is of type xs:anyURI)
conveys the [message id] property.</p>
</dd>
<dt class="label">/wsa:RelatesTo</dt>
<dd>
<p>This OPTIONAL (repeating) element information item contributes
one abstract [relationship] property value, in the form of an (IRI,
IRI) pair. The content of this element (of type xs:anyURI) conveys
the [message id] of the related message.</p>
</dd>
<dt class="label">/wsa:RelatesTo/@RelationshipType</dt>
<dd>
<p>This OPTIONAL attribute (of type xs:anyURI) conveys the
relationship type as an IRI. When absent, the implied value of this
attribute is "http://www.w3.org/2005/08/addressing/reply".</p>
</dd>
<dt class="label">/[reference parameters]*</dt>
<dd>
<p>Each element information item found in [reference parameters]
(including all of that elements [children], [attributes] and
[in-scope namespaces]) is represented as is.</p>
</dd>
</dl>
<p>Note that each of the element information items described above
allows attribute wildcards for future extensibility. A message
processor may safely ignore any extension attribute it does not
recognize. Attribute extensibility allows use of
xml:id[<cite><a href="#XMLID">xml:id</a></cite>] for identification
of these elements if desired.</p>
<div class="div3">
<h4><a name="compiri" id="compiri"></a>3.2.1 Comparing IRIs</h4>
<p>The values of the Message Addressing Properties [action],
[message id], and [relationship] are absolute IRIs. The purpose of
these IRIs is primarily identification, rather than resource
retrieval. As such, simple string comparison, as indicated in
Internationalized Resource Identifiers <cite><a href=
"#RFC3987">IETF RFC 3987</a></cite> section 5.3.1, is sufficient to
determine equivalence of these IRIs.</p>
<p>Comparison of [destination] property values is out of scope,
other than using simple string comparison to detect whether the
value is anonymous, that is, where [destination] has the value
"http://www.w3.org/2005/08/addressing/anonymous".</p>
</div>
</div>
<div class="div2">
<h3><a name="sendmsgepr" id="sendmsgepr"></a>3.3 Sending a Message
to an EPR</h3>
<p>This section describes the process of constructing a message in
accordance to an EPR.</p>
<ol>
<li>
<p>If the EPR's [address] property is
"http://www.w3.org/2005/08/addressing/none" the message is
discarded, if not then populate the message's message addressing
properties:</p>
<ul>
<li>
<p>[action]: this property is required, but is not populated from
the EPR.</p>
</li>
<li>
<p>[destination]: this property takes the value of the EPR's
[address] property.</p>
</li>
<li>
<p>[reference parameters]: this property takes the value of the
selected EPR's [reference parameters] property</p>
</li>
</ul>
</li>
</ol>
</div>
<div class="div2">
<h3><a name="formreplymsg" id="formreplymsg"></a>3.4 Formulating a
Reply Message</h3>
<p>This section specifies the WS-Addressing-specific rules for
creating a reply or fault message related to another message.</p>
<ol>
<li>
<p>Select the appropriate EPR:</p>
<ul>
<li>
<p>If the reply is a normal message, select the EPR from the
related message's [reply endpoint] message addressing property.</p>
<div class="note">
<p class="prefix"><b>Note:</b></p>
<p>The [reply endpoint] message addressing property will always be
present when using the XML Infoset representation since, in the
absence of a wsa:ReplyTo element, the value of the [reply endpoint]
message addressing property defaults to an EPR with an [address]
property of "http://www.w3.org/2005/08/addressing/anonymous" - see
section <a href="#msgaddrpropsinfoset"><b>3.2 XML Infoset
Representation of Message Addressing Properties</b></a>.</p>
</div>
<p>If the [reply endpoint] message addressing property is not
present the processor MUST fault. This could only occur when using
an alternate representation of message addressing properties.</p>
</li>
<li>
<p>Otherwise, if the reply is a fault message and the related
message's [fault endpoint] message addressing property is not
empty, select the EPR from that property. If the [fault endpoint]
property is empty, select the EPR from the related message's [reply
endpoint] message addressing property. Otherwise, if the [reply
endpoint] property is empty, the behavior of the recipient of the
related message is unconstrained by this specification.</p>
</li>
<li>
<p>In either of the above cases, if the related message lacks a
[message id] property, the processor MUST fault.</p>
</li>
</ul>
</li>
<li>
<p>Send the message according to the previous section, but also
including:</p>
<ul>
<li>
<p>[relationship]: this property MUST include a pair of IRIs as
follows; the relationship type is the predefined reply URI
"http://www.w3.org/2005/08/addressing/reply" and the related
message's identifier is the [message id] property value from the
message being replied to; other relationships MAY be expressed in
this property</p>
</li>
</ul>
</li>
</ol>
<p>The following example illustrates a message containing message
addressing properties serialized as header blocks in a SOAP 1.2
message:</p>
<div class="exampleOuter">
<p style="text-align: left" class="exampleHead"><i><span>Example
3-1.</span> Example message.</i></p>
<div class="exampleInner">
<pre>
&lt;S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope"
  xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
  &lt;S:Header&gt;
  &lt;wsa:MessageID&gt;http://example.com/someuniquestring&lt;/wsa:MessageID&gt;
    &lt;wsa:ReplyTo&gt;
      &lt;wsa:Address&gt;http://example.com/business/client1&lt;/wsa:Address&gt;
    &lt;/wsa:ReplyTo&gt;
    &lt;wsa:To&gt;mailto:fabrikam@example.com&lt;/wsa:To&gt;
    &lt;wsa:Action&gt;http://example.com/fabrikam/mail/Delete&lt;/wsa:Action&gt;
  &lt;/S:Header&gt;
  &lt;S:Body&gt;
    &lt;f:Delete xmlns:f="http://example.com/fabrikam"&gt;
       &lt;maxCount&gt;42&lt;/maxCount&gt;
    &lt;/f:Delete&gt;
  &lt;/S:Body&gt;
&lt;/S:Envelope&gt;

</pre></div>
</div>
<p>This message would have the following property values:</p>
<ul>
<li>
<p>[destination]: "mailto:fabrikam@example.com"</p>
</li>
<li>
<p>[reply endpoint]: The endpoint with [address]
"http://example.com/business/client1"</p>
</li>
<li>
<p>[action]: "http://example.com/fabrikam/mail/Delete"</p>
</li>
<li>
<p>[message id]: "http://example.com/someuniquestring"</p>
</li>
</ul>
<p>The following example illustrates a reply to the above
message:</p>
<div class="exampleOuter">
<p style="text-align: left" class="exampleHead"><i><span>Example
3-2.</span> Example reply message.</i></p>
<div class="exampleInner">
<pre>
&lt;S:Envelope
  xmlns:S="http://www.w3.org/2003/05/soap-envelope"
  xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
  &lt;S:Header&gt;
    &lt;wsa:MessageID&gt;http://example.com/someotheruniquestring&lt;/wsa:MessageID&gt;
    &lt;wsa:RelatesTo&gt;http://example.com/someuniquestring&lt;/wsa:RelatesTo&gt;
    &lt;wsa:To&gt;http://example.com/business/client1&lt;/wsa:To&gt;
    &lt;wsa:Action&gt;http://example.com/fabrikam/mail/DeleteAck&lt;/wsa:Action&gt;
  &lt;/S:Header&gt;
  &lt;S:Body&gt;
    &lt;f:DeleteAck xmlns:f="http://example.com/fabrikam"/&gt;
  &lt;/S:Body&gt;
&lt;/S:Envelope&gt;

</pre></div>
</div>
<p>This message would have the following property values:</p>
<ul>
<li>
<p>[destination]: "http://example.com/business/client1"</p>
</li>
<li>
<p>[action]: "http://example.com/fabrikam/mail/DeleteAck"</p>
</li>
<li>
<p>[message id]: "http://example.com/someotheruniquestring"</p>
</li>
<li>
<p>[relationship]: ("http://www.w3.org/2005/08/addressing/reply",
"http://example.com/someuniquestring")</p>
</li>
</ul>
</div>
</div>
<div class="div1">
<h2><a name="securityconsiderations" id=
"securityconsiderations"></a>4. Security Considerations</h2>
<p>Conformance to this specification does not require a message
receiver to honor the WS-Addressing constructs within a message if
the receiver is not satisfied that the message is safe to
process.</p>
<p>WS-Addressing supports capabilities that allow a message sender
to instruct a message receiver to send additional unsolicited
messages to other receivers of their choice. To an extent the
content of such unsolicited messages can also be controlled using
reference parameters supplied by the initial message sender.
Because of these capabilities it is essential that communications
using WS-Addressing are adequately secured and that a sufficient
level of trust is established between the communicating parties
before a receiver processes WS-Addressing constructs within a
message. There are several aspects to securing a message:</p>
<ol>
<li>
<p>EPRs and message addressing properties should be
integrity-protected to prevent tampering. Such integrity protection
might be provided by the transport, a message level signature, or
use of an XML digital signature within EPRs.</p>
</li>
<li>
<p>Users of EPRs should validate the trustworthiness of an EPR
before using it by considering the following aspects:</p>
<ol>
<li>
<p>whether the EPR was obtained from a trusted source</p>
</li>
<li>
<p>whether the EPR was obtained from a source with authority to
represent the [address] of that EPR</p>
</li>
<li>
<p>whether the [address] of the EPR is a trusted destination</p>
</li>
</ol>
</li>
</ol>
<p>For example, the receiver of a message might rely on the
presence of a verifiable signature by a trusted party over the
message addressing properties to determine that the message
originated from a trusted source and further require that the
[reply endpoint] and [fault endpoint] are signed by a principle
with authority to represent the [address] of those EPRs to ensure
that unsolicted messages are not sent. Alternatively an out-of-band
means of establishing trust might be used to determine whether a
particular EPR is trustworthy.</p>
<div class="div2">
<h3><a name="id2270741" id="id2270741"></a>4.1 Additional Security
Considerations</h3>
<p>To prevent information disclosure, EPR issuers should not put
sensitive information into the [address] or [reference parameters]
properties unless it has been adequately protected against
arbitrary disclosure.</p>
<p>Some processors may use [message id] as part of a uniqueness
metric in order to detect message replay. Care should be taken to
ensure that, for purposes of replay detection, [message id] is
composed from data, such as a timestamp, such that a legitimate
retransmission of the message is not confused with a replay attack.
It is also advisable to use a [message id] that is not predictable,
to prevent attackers from constructing and sending an unsolicited
reply to a message without having to see the actual message.</p>
</div>
</div>
<div class="div1">
<h2><a name="references" id="references"></a>5. References</h2>
<div class="div2">
<h3><a name="Normative-References" id=
"Normative-References"></a>5.1 Normative References</h3>
<dl>
<dt class="label"><a name="RFC2119" id="RFC2119"></a>[IETF RFC
2119]</dt>
<dd><cite><a href="http://www.ietf.org/rfc/rfc2119.txt">Key words
for use in RFCs to Indicate Requirement Levels</a></cite>, S.
Bradner, Author. Internet Engineering Task Force, June 1999.
Available at http://www.ietf.org/rfc/rfc2119.txt.</dd>
<dt class="label"><a name="RFC3987" id="RFC3987"></a>[IETF RFC
3987]</dt>
<dd><cite><a href=
"http://www.ietf.org/rfc/rfc3987.txt">Internationalized Resource
Identifiers (IRIs)</a></cite> M. Duerst, and M. Suignard, Authors.
Internet Engineering Task Force, January 2005. Available at
http://www.ietf.org/rfc/rfc3987.txt.</dd>
<dt class="label"><a name="XML10" id="XML10"></a>[XML 1.0]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2004/REC-xml-20040204">Extensible Markup
Language (XML) 1.0 (Third Edition)</a></cite>, T. Bray, J. Paoli,
C. M. Sperberg-McQueen, and E. Maler, Editors. World Wide Web
Consortium, 4 February 2004. This version of the XML 1.0
Recommendation is http://www.w3.org/TR/2004/REC-xml-20040204. The
<a href="http://www.w3.org/TR/REC-xml">latest version of XML
1.0</a> is available at http://www.w3.org/TR/REC-xml.</dd>
<dt class="label"><a name="XMLNS" id="XMLNS"></a>[XML
Namespaces]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/1999/REC-xml-names-19990114">Namespaces in
XML</a></cite>, T. Bray, D. Hollander, and A. Layman, Editors.
World Wide Web Consortium, 14 January 1999. This version of the XML
Information Set Recommendation is
http://www.w3.org/TR/1999/REC-xml-names-19990114. The <a href=
"http://www.w3.org/TR/REC-xml-names">latest version of Namespaces
in XML</a> is available at http://www.w3.org/TR/REC-xml-names.</dd>
<dt class="label"><a name="XMLInfoSet" id="XMLInfoSet"></a>[XML
Information Set]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2004/REC-xml-infoset-20040204/">XML
Information Set (Second Edition)</a></cite>, J. Cowan and R. Tobin,
Editors. World Wide Web Consortium, 4 February 2004. This version
of the XML Information Set Recommendation is
http://www.w3.org/TR/2004/REC-xml-infoset-20040204. The <a href=
"http://www.w3.org/TR/xml-infoset/">latest version of XML
Information Set</a> is available at
http://www.w3.org/TR/xml-infoset.</dd>
<dt class="label"><a name="XMLSchemaP1" id="XMLSchemaP1"></a>[XML
Schema Structures]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2004/REC-xmlschema-1-20041028/">XML Schema
Part 1: Structures Second Edition</a></cite>, H. Thompson, D.
Beech, M. Maloney, and N. Mendelsohn, Editors. World Wide Web
Consortium, 28 October 2004. This version of the XML Schema Part 1
Recommendation is
http://www.w3.org/TR/2004/REC-xmlschema-1-20041028. The <a href=
"http://www.w3.org/TR/xmlschema-1/">latest version of XML Schema
Part 1</a> is available at http://www.w3.org/TR/xmlschema-1.</dd>
<dt class="label"><a name="XMLSchemaP2" id="XMLSchemaP2"></a>[XML
Schema Datatypes]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2004/REC-xmlschema-2-20041028/">XML Schema
Part 2: Datatypes Second Edition</a></cite>, P. Byron and A.
Malhotra, Editors. World Wide Web Consortium, 28 October 2004. This
version of the XML Schema Part 2 Recommendation is
http://www.w3.org/TR/2004/REC-xmlschema-2-20041028. The <a href=
"http://www.w3.org/TR/xmlschema-2/">latest version of XML Schema
Part 2</a> is available at http://www.w3.org/TR/xmlschema-2.</dd>
</dl>
</div>
<div class="div2">
<h3><a name="Informative-References" id=
"Informative-References"></a>5.2 Other References</h3>
<dl>
<dt class="label"><a name="AoWWW" id="AoWWW"></a>[AoWWW]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2004/REC-webarch-20041215/">Architecture of
the World Wide Web, Volume One</a></cite>, I. Jacobs, and N. Walsh,
Editors. World Wide Web Consortium, 15 December 2004. This version
of the Architecture of the World Wide Web, Volume One
Recommendation is at
http://www.w3.org/TR/2004/REC-webarch-20041215/. The latest version
is available at http://www.w3.org/TR/webarch/</dd>
<dt class="label"><a name="SOAP11" id="SOAP11"></a>[SOAP 1.1]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2000/NOTE-SOAP-20000508/">Simple Object
Access Protocol (SOAP) 1.1</a></cite>, D. Box, et al, Editors.
World Wide Web Consortium, 8 May 2000. Available at
http://www.w3.org/TR/2000/NOTE-SOAP-20000508/.</dd>
<dt class="label"><a name="SOAP12-PART1" id=
"SOAP12-PART1"></a>[SOAP 1.2 Messaging Framework]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2003/REC-soap12-part1-20030624/">SOAP Version
1.2 Part 1: Messaging Framework</a></cite>, M. Gudgin, M. Hadley,
N. Mendelsohn, J-J. Moreau, and H. Frystyk Nielsen, Editors. W3C
Recommendation, World Wide Web Consortium, 24 June 2003. This
version of the SOAP Version 1.2 Part 1: Messaging Framework
Recommendation is
http://www.w3.org/TR/2003/REC-soap12-part1-20030624/. The <a href=
"http://www.w3.org/TR/soap12-part1/">latest version of SOAP Version
1.2 Part 1: Messaging Framework</a> is available at
http://www.w3.org/TR/soap12-part1/.</dd>
<dt class="label"><a name="WSADDR-SOAP" id=
"WSADDR-SOAP"></a>[WS-Addressing SOAP Binding]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2006/REC-ws-addr-soap-20060509">Web Services
Addressing 1.0 - SOAP Binding</a></cite>, M. Gudgin, M. Hadley, and
T. Rogers, Editors. World Wide Web Consortium, 9 May 2006. This
version of the WS-Addressing SOAP Binding Recommendation is
http://www.w3.org/TR/2006/REC-ws-addr-soap-20060509. The <a href=
"http://www.w3.org/TR/ws-addr-soap">latest version of WS-Addressing
SOAP Binding</a> is available at
http://www.w3.org/TR/ws-addr-soap.</dd>
<dt class="label"><a name="WSADDR-WSDL" id=
"WSADDR-WSDL"></a>[WS-Addressing WSDL Binding]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2006/WD-ws-addr-wsdl-20060216">Web Services
Addressing 1.0 - WSDL Binding</a></cite>, M. Gudgin, M. Hadley, T.
Rogers, and Ü. Yalçinalp, Editors. World Wide Web Consortium, 16
February 2006. This version of the WS-Addressing WSDL Binding
specification is
http://www.w3.org/TR/2006/WD-ws-addr-wsdl-20060216. The <a href=
"http://www.w3.org/TR/ws-addr-wsdl">latest version of WS-Addressing
WSDL Binding</a> is available at
http://www.w3.org/TR/ws-addr-wsdl.</dd>
<dt class="label"><a name="WSDL11" id="WSDL11"></a>[WSDL 1.1]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2001/NOTE-wsdl-20010315">Web Services
Description Language (WSDL) 1.1</a></cite>, E. Christensen, et al,
Authors. World Wide Web Consortium, March 2001. Available at
http://www.w3.org/TR/2001/NOTE-wsdl-20010315.</dd>
<dt class="label"><a name="WSDL20" id="WSDL20"></a>[WSDL 2.0 Core
Language]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2006/CR-wsdl20-20060327">Web Services
Description Language (WSDL) Version 2.0 Part 1: Core
Language</a></cite>, R. Chinnici, J. J. Moreau, A. Ryman, and S.
Weerawarana, Editors. World Wide Web Consortium, 27 March 2006.
This version of the WSDL 2.0 specification is
http://www.w3.org/TR/2006/CR-wsdl20-20060327. The <a href=
"http://www.w3.org/TR/wsdl20">latest version of WSDL 2.0</a> is
available at http://www.w3.org/TR/wsdl20.</dd>
<dt class="label"><a name="WS-Security" id=
"WS-Security"></a>[WS-Security 2004]</dt>
<dd><cite><a href=
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf">
Web Services Security: SOAP Message Security 1.0 (WS-Security
2004)</a></cite>, A. Nadalin, C. Kaler, P. Hallam-Baker, and R.
Monzillo, Editors. Organization for the Advancement of Structured
Information Standards, March 2004. Available at
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf.</dd>
<dt class="label"><a name="XMLID" id="XMLID"></a>[xml:id]</dt>
<dd><cite><a href=
"http://www.w3.org/TR/2005/REC-xml-id-20050909/">xml:id Version
1.0</a></cite>, J. Marsh, D. Veillard, and N. Walsh, Editors. World
Wide Web Consortium, 9 September 2005. This version of the xml:id
Version 1.0 Recommendation is
http://www.w3.org/TR/2005/REC-xml-id-20050909/. The <a href=
"http://www.w3.org/TR/xml-id/">latest version of xml:id</a> is
available at http://www.w3.org/TR/xml-id/.</dd>
</dl>
</div>
</div>
</div>
<div class="back">
<div class="div1">
<h2><a name="acknowledgments" id="acknowledgments"></a>A.
Acknowledgements (Non-Normative)</h2>
<p>This document is the work of the <a href=
"http://www.w3.org/2002/ws/addr/">W3C Web Service Addressing
Working Group</a>.</p>
<p>Members of the Working Group are (at the time of writing, and by
alphabetical order): Abbie Barbir (Nortel Networks), Andreas
Bjärlestam (ERICSSON), Dave Chappell (Sonic Software), Eran
Chinthaka (WSO2), Francisco Curbera (IBM Corporation), Glen Daniels
(Sonic Software), Vikas Deolaliker (Sonoa Systems, Inc.), Paul
Downey (BT), Jacques Durand (Fujitsu Limited), Robert Freund
(Hitachi, Ltd.), Marc Goodner (Microsoft Corporation), Arun Gupta
(Sun Microsystems, Inc.), Hugo Haas (W3C/ERCIM), Marc Hadley (Sun
Microsystems, Inc.), David Hull (TIBCO Software, Inc.), Yin-Leng
Husband (HP), David Illsley (IBM Corporation), Anish Karmarkar
(Oracle Corporation), Paul Knight (Nortel Networks), Philippe Le
Hégaret (W3C/MIT), Amelia Lewis (TIBCO Software, Inc.), Bozhong Lin
(IONA Technologies, Inc.), Mark Little (JBoss Inc.), Jonathan Marsh
(Microsoft Corporation), Jeff Mischkinsky (Oracle Corporation),
Nilo Mitra (ERICSSON), Eisaku Nishiyama (Hitachi, Ltd.), Ales Novy
(Systinet Inc.), David Orchard (BEA Systems, Inc.), Gilbert Pilz
(BEA Systems, Inc.), Alain Regnier (Ricoh Company, Ltd.), Tony
Rogers (Computer Associates), Tom Rutt (Fujitsu Limited), Davanum
Srinivas (WSO2), Jiri Tejkl (Systinet Inc.), Mike Vernal (Microsoft
Corporation), Steve Vinoski (IONA Technologies, Inc.), Katy Warr
(IBM Corporation), Pete Wenzel (Sun Microsystems, Inc.), Steve
Winkler (SAP AG), Ümit Yalçinalp (SAP AG), Prasad Yendluri
(webMethods, Inc.).</p>
<p>Previous members of the Working Group were: Lisa Bahler (SAIC -
Telcordia Technologies), Rebecca Bergersen (IONA Technologies,
Inc.), Ugo Corda (Sun Microsystems, Inc.), Michael Eder (Nokia),
Yaron Goland (BEA Systems, Inc.), Marc Goodner (SAP AG), Martin
Gudgin (Microsoft Corporation), Mark Nottingham (BEA Systems,
Inc.), Mark Peel (Novell, Inc.), Harris Reynolds (webMethods,
Inc.), Rich Salz (IBM Corporation), Davanum Srinivas (Computer
Associates), Greg Truty (IBM Corporation).</p>
<p>The people who have contributed to <a href=
"http://lists.w3.org/Archives/Public/public-ws-addressing/">discussions
on public-ws-addressing@w3.org</a> are also gratefully
acknowledged.</p>
</div>
</div>
</body>
</html>