wse-php
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
22, Aug 2026, 3.0.0
Features:
- Add wse-php.php bootstrap for non-Composer installs (loads vendor/autoload.php
  or a sibling xmlseclibs checkout)
- Add GitHub Actions CI workflow and PHPUnit .phpt regression tests

Requirements (breaking):
- Require PHP 8.1+ (2.x supported PHP 5.3+)
- Require robrichards/xmlseclibs ^4.0 (2.x required >= 3.0.4)

Improvements:
- Add soap-server-sign-encrypt.php server-side example (decrypt, verify, sign,
  encrypt response). Refs #8
- WSSESoapServer::getSigningKey() returns the key used to verify the last
  processed signature (e.g. caller certificate thumbprint). Refs #49
- WSSESoap::addUserToken() accepts optional $addNonce and $addCreated flags
  (default true for backward compatibility). Refs #66
- WSSESoap::attachX509DatatoSig() attaches Issuer/Serial KeyInfo to a signature.
  Refs #32
- WSASoap::addMessageID() returns the generated MessageID
- WSASoap uses the WS-Addressing 2005 anonymous URI when the 2005 namespace is
  in use (From / ReplyTo)
- WSSESoap matches and sets SOAP 1.2 Security header role (not actor)
- WSSESoap inserts EncryptedKey before Signature for correct sign-then-encrypt
  Security header ordering
- WSSESoap addEncryptedKey() accepts an XMLSecurityKey or BinarySecurityToken
  DOM element; validate X509SubjectKeyIdentifier inputs
- WSSESoap decryptSoapDoc() throws on invalid or missing EncryptedData references
  instead of fatalling
- WSSESoap EncryptBody() throws when the SOAP Body cannot be located

Security Improvements:
- WSSESoapServer: require verify() === 1; the previous loose "!verify()" check
  treated -1 (verification error, e.g. malformed embedded certificate) as success,
  allowing a signature authentication bypass

Bug Fixes:
- WSSESoap::decryptSoapDoc() removes DataReferences after successful decrypt
  and drops empty EncryptedKey / Security header nodes. Refs #7
- WSSESoapServer: fix undefined $secnode when the Security header is empty (#56)
- WSSESoapServer: load embedded X509 certificates with isCert=true
- WSSESoap: fix X509SubjectKeyIdentifier signing when Signature is the sole
  Security header child
- WSSESoap: fix sibling traversal in addEncryptedKey() (nextSibling, not
  nextChild)

11 May 2020, 2.0.4
Improvements:
- Add support for variable WSA NS in RelatesTo field. PR #55
- Add missing EncodingType attribute in addUserToken. PR #36
- Make it possible to only sign specific header nodes. PR #47

Bug Fixes:
- Fix undefined index notice. Refs #48

03 Jan 2019, 2.0.3
Improvements:
- Change private properties to protected, so it can be extended. Refs #41
- Add private key passphrase option to decryptSoapDoc. Refs #40
- Adding option to use 2005 NS in WSA headers. Refs #46

Features:
- Adds support for WSA RelatesTo. Refs #45

31 Aug 2017, 2.0.2
Features:
- Add WSA From. Refs #29

Improvements:
- Allow xmlseclibs 2.x and 3.x
- Remove composer lock file as too many varying deps being tested against

09 Mar 2017, 2.0.1
Improvements:
- Change depreciated split to explode.

21 Oct 2016, 2.0.0
Features:
- Upgrade to use namespaces. Requires PHP 5.3+.

Bug Fixes:
- Add ValueType attribute when attaching token

24 Jun 2015, 1.1.0
Features:
- Add options parameter to signSoapDoc() method.
  options include insertBefore and KeyInfo array (X509SubjectKeyIdentifier).
- Add options parameter to addEncryptedKey() method.
  options include KeyInfo array (X509SubjectKeyIdentifier).
- Add encryptSoapDoc() method
- Add decryptSoapDoc() method
- Libraries now provide ability to interoperate with WCF servers using message 
  level security (Signatures and Encryption).
- Add signBody property (boolean) to allow for disabling of signing soap body.

08 Mar 2010, 1.0.0
Initial import of libraries to repository from cdatazone web site
Provides support for Digital Sigatures via WS-Security and WS-Addressing