Web Services Implementation: SOAP, REST, Security & Integration

Phase 5 — Security & Standards

Why Security Matters for Web Services

A web service exposed on the internet is accessible by anyone — including attackers. Without security, someone can call your payment API, flood your server with fake requests, steal user data, or impersonate legitimate users.

Security Layers

• 🔒 Transport Security (HTTPS) — Encrypts data in transit using TLS/SSL. Prevents eavesdropping. Mandatory for any public API.
• 🗝️ API Keys — A secret token passed in headers. Simple, effective for server-to-server calls. e.g., X-API-Key: abc123xyz
• 🎟️ OAuth 2.0 — Industry standard for delegated authorization. "Login with Google" uses OAuth. Returns a time-limited token.
• 📋 JWT (JSON Web Token) — A signed token containing user claims. Server validates the signature — no DB lookup needed per request.
• 🛡️ WS-Security (SOAP) — XML-based message-level security. Signs and encrypts individual SOAP elements. Used in banking SOAP services.

Common Web Service Attacks

• ⚡ Injection Attacks — Malicious XML/JSON in input fields. Always validate and sanitize all input.
• 🌊 DDoS / Rate Abuse — Flooding the service with thousands of calls. Fix: Rate limiting (e.g., 100 requests/minute per key).
• 🕵️ Man-in-the-Middle — Intercepting unencrypted traffic. Fix: Always use HTTPS — never HTTP in production.
• 🔑 Broken Authentication — Weak or exposed API keys. Fix: Rotate keys, never log them, store in environment variables.

XML Security Standards: WS-Security is built entirely on XML. It adds a <wsse:Security> element to the SOAP Header — containing <wsse:UsernameToken>, <ds:Signature>, and <xenc:EncryptedData> — all XML standards you can parse and read.

Lab 5 — API Key Authentication in Flask

Objective: Add API key authentication to the Books REST API from Lab 4. Test both authorized (200) and unauthorized (401) access using Postman.

Step 1 — Add API Key Authentication Decorator

Add these lines to your books_api.py from Lab 4:

from functools import wraps

# Valid API keys (in production, store in DB or env vars)
VALID_KEYS = {"key_student_001", "key_faculty_999"}

def require_api_key(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        key = request.headers.get("X-API-Key")
        if not key or key not in VALID_KEYS:
            return jsonify({
                "error":   "Unauthorized",
                "message": "Valid X-API-Key header required"
            }), 401
        return f(*args, **kwargs)
    return decorated

# Protect your routes by adding @require_api_key decorator
@app.route('/books', methods=['GET'])
@require_api_key  # <-- Add this line above each route
def get_books():
    return jsonify(books), 200

Step 2 — Test Without API Key (Should Fail)

In Postman: GET http://localhost:5000/books — no headers added.

Expected: HTTP 401 — {"error": "Unauthorized", "message": "Valid X-API-Key header required"}

Step 3 — Test With Valid API Key (Should Succeed)

In Postman: GET http://localhost:5000/books

Under Headers tab: Key = X-API-Key | Value = key_student_001

Expected: HTTP 200 — Full list of books in JSON

Step 4 — Study a WS-Security Header (SOAP)

This WS-Security header is just SOAP Header XML — notice its structure:

<soap:Header>
  <wsse:Security
    xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/12/secext">
    <wsse:UsernameToken>
      <wsse:Username>student_user</wsse:Username>
      <wsse:Password
        Type="PasswordDigest">hashed_password_here</wsse:Password>
    </wsse:UsernameToken>
  </wsse:Security>
</soap:Header>

This is WS-Security at its core — just XML nested inside a SOAP Header element.

Common Errors + Fixes:

• 401 even with correct key → Check for typos. Headers are case-sensitive on some servers.
• AttributeError: NoneType → request.headers.get() returns None if header not present — handle it with if not key check.
• CORS errors in browser → Install flask-cors: pip install flask-cors and add CORS(app) after creating Flask app.

Security Rule: Never hardcode API keys in source code. In production, use environment variables: import os; key = os.environ.get('API_KEY') and store keys in a .env file (add .env to .gitignore!).

Phase 6 — Mini Project: Full Integration

Project: Student Result + Country Enrichment Service

Build a REST API that manages student results AND enriches each student's record with their home country info by calling an external public API — demonstrating service-to-service communication.

System Architecture

[ Postman / Mobile App / Browser ]
         |
         | HTTP + API Key in header
         v
[ Your Flask REST API ] --- student data in memory
         |
         | Calls external REST API (on GET /students/{id})
         v
[ restcountries.com/v3.1 ] --- country database
         |
         +---> Returns enriched student record with country details

Endpoints to Build

• GET /students — All students (protected)
• GET /students/{rollNo} — Student + live country info from external API
• POST /students — Add student (protected)
• PUT /students/{rollNo}/marks — Update marks (protected)
• DELETE /students/{rollNo} — Remove student (protected)

Lab 6 — Complete Mini Project Code

Step 1 — Install Dependencies

pip install flask requests

Step 2 — Create mini_project.py

from flask import Flask, request, jsonify
import requests
from functools import wraps

app = Flask(__name__)

# ── Config ─────────────────────────────────────────
VALID_KEYS  = {"key_student_001", "key_faculty_999"}
COUNTRY_API = "https://restcountries.com/v3.1/name/{}"

# ── Data Store ──────────────────────────────────────
students = {
    "CS001": {"name": "Priya Sharma", "marks": 87, "country": "India"},
    "CS002": {"name": "Yuki Tanaka",  "marks": 92, "country": "Japan"},
    "CS003": {"name": "Lena Mueller", "marks": 78, "country": "Germany"},
}

# ── Auth Decorator ──────────────────────────────────
def require_api_key(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        key = request.headers.get("X-API-Key")
        if key not in VALID_KEYS:
            return jsonify({"error": "Unauthorized"}), 401
        return f(*args, **kwargs)
    return decorated

# ── External API Call ───────────────────────────────
def get_country_info(country_name):
    try:
        resp = requests.get(
            COUNTRY_API.format(country_name.lower()),
            timeout=3
        )
        if resp.status_code == 200:
            data = resp.json()[0]
            return {
                "capital":    data.get("capital", ["N/A"])[0],
                "population": data.get("population", 0),
                "currency":   list(data.get("currencies", {}).keys())[0]
            }
    except Exception:
        pass
    return {"capital": "N/A", "population": 0, "currency": "N/A"}

# ── Routes ──────────────────────────────────────────

@app.route('/students', methods=['GET'])
@require_api_key
def get_students():
    return jsonify(students), 200

@app.route('/students/<roll_no>', methods=['GET'])
@require_api_key
def get_student(roll_no):
    student = students.get(roll_no)
    if not student:
        return jsonify({"error": "Student not found"}), 404
    # Call external REST API to enrich our data
    country_info = get_country_info(student["country"])
    enriched = {**student, "country_details": country_info}
    return jsonify(enriched), 200

@app.route('/students', methods=['POST'])
@require_api_key
def add_student():
    data = request.get_json()
    roll = data.get("rollNo")
    if not roll or roll in students:
        return jsonify({"error": "Invalid or duplicate roll number"}), 400
    students[roll] = {
        "name":    data.get("name", "Unknown"),
        "marks":   data.get("marks", 0),
        "country": data.get("country", "India")
    }
    return jsonify({"message": "Student added", "rollNo": roll}), 201

@app.route('/students/<roll_no>/marks', methods=['PUT'])
@require_api_key
def update_marks(roll_no):
    if roll_no not in students:
        return jsonify({"error": "Not found"}), 404
    data = request.get_json()
    students[roll_no]["marks"] = data.get("marks", students[roll_no]["marks"])
    return jsonify(students[roll_no]), 200

@app.route('/students/<roll_no>', methods=['DELETE'])
@require_api_key
def delete_student(roll_no):
    if roll_no not in students:
        return jsonify({"error": "Not found"}), 404
    del students[roll_no]
    return jsonify({"message": f"{roll_no} deleted"}), 200

if __name__ == '__main__':
    print("Mini Project API: http://localhost:5000")
    app.run(debug=True, port=5000)

Step 3 — Run & Test All Endpoints

# Header: X-API-Key: key_student_001

# Test 1: Get all students
GET  http://localhost:5000/students

# Test 2: Get student with LIVE country data (calls external API!)
GET  http://localhost:5000/students/CS002

# Test 3: Add new student
POST http://localhost:5000/students
Body: {"rollNo":"CS004","name":"Ali Hassan","marks":85,"country":"Egypt"}

# Test 4: Update marks
PUT  http://localhost:5000/students/CS001/marks
Body: {"marks": 95}

# Test 5: Delete student
DELETE http://localhost:5000/students/CS003

# Test 6: Unauthorized access (no API key)
GET  http://localhost:5000/students  → Should return 401

Step 4 — Observe the Enriched Response

GET /students/CS002 returns Yuki Tanaka's data PLUS live country info from external REST API:

{
  "name":    "Yuki Tanaka",
  "marks":   92,
  "country": "Japan",
  "country_details": {
    "capital":    "Tokyo",
    "population": 125681593,
    "currency":   "JPY"
  }
}

Common Errors + Fixes:

• ConnectionError on country API → Check internet connection. The try/except handles this gracefully.
• KeyError: capital → Country name may not match exactly. Try lowercase. The external API is case-flexible.
• Timeout error → Increase: requests.get(..., timeout=5)