Signing multiple objects?

[Cantor, Scott]

On 10/29/11 7:40 PM, "Brad Cox" <bradjcox at gmail.com> wrote:

>Scott, when you spoke of "signing the whole document", do you mean giving
>the soap envelope an id and signing the envelope?

No, I mean URI="".

Using an ID implies that you have code in place to prevent wrapping
attacks. We do for SAML. You wouldn't for SOAP, and none of the code
you're working with will either.

-- Scott