Before you begin
Prior to completing this task, you must import your application into an assembly tool. For information on how to import your application, see Importing enterprise applications.Why and when to perform this task
Nonce for confidentiality is used to specify that the nonce is embedded in a particular element within the message and that the element is encrypted. Nonce is a randomly generated, cryptographic token. When you add a nonce to a specific part of a message, it can prevent theft and replay attacks because a generated nonce is unique. For example, without a nonce, the token might be intercepted and used in a replay attack when a user name token is passed from one machine to another machine using a non-secure transport, such as HTTP. The user name token can be stolen even if you use XML digital signature and XML encryption. This situation might be prevented by adding a nonce.
Complete the following steps to specify a nonce for confidentiality using an XPath expression when you configure the generator security constraints for either the request generator or the response generator. The request generator is configured for the client and the response generator is configured for the server. In the following steps, you must configure either the client-side extensions in step 2 or the server-side extensions in step 3.
Steps for this task
/*[namespace-uri()='http://schemas.xmlsoap.org/soap/envelope/' and local-name()='Envelope']/*[namespace-uri()='http://schemas.xmlsoap.org/ soap/envelope/' and local-name()='Bodycontent']
What to do next
After you specify which message parts to encrypt, you must specify which method is used to encrypt sign the message. For more information, see Configuring encryption information for the generator binding with an assembly tool.Related concepts
XML digital signature
Related tasks
Adding time stamps for confidentiality to generator security constraints
with keywords
Adding time stamps for confidentiality to generator security constraints
with an XPath expression
Configuring encryption information for the generator binding with an
assembly tool