Editing WS-Security (section)

==Use cases==
===End-to-end security===
If a SOAP intermediary is required, and the intermediary is not more or less trusted, messages need to be signed and optionally encrypted. This might be the case of an application-level proxy at a network perimeter that will terminate TCP (transmission control protocol) connections.

===Non-repudiation===
One method for [[non-repudiation]] is to write transactions to an audit trail that is subject to specific security safeguards. Digital signatures, which WS-Security supports, provide a more direct and verifiable non-repudiation proof.

===Alternative transport bindings===
Although almost all SOAP services implement HTTP bindings, in theory other bindings such as [[Java Message Service|JMS]] or SMTP could be used; in this case end-to-end security would be required.

===Reverse proxy/common security token===
Even if the web service relies upon transport layer security, it might be required for the service to know about the end user, if the service is relayed by a (HTTP-) reverse proxy. A WSS header could be used to convey the end user's token, vouched for by the reverse proxy.