RE: [wss] Recently discover WSS security threat

[Rich Salz <rsalz@datapower.com>]

> So whatever transform you use, the *output* of the transform has to look
> like:

I don't see why.  If the application has access to the output of the
transform, I can see why it's useful.  Using the simple XPath,
the signature will break is the single identifier header isn't where
it's supposed to be.  I must be missing something...
	/r$

-- 
Rich Salz                  Chief Security Architect
DataPower Technology       http://www.datapower.com
XS40 XML Security Gateway  http://www.datapower.com/products/xs40.html