"Hung Ngo" <HungNgo@discussions.microsoft.com> wrote in message
news:CDAA27AA-71CD-4098-B5CB-E22999F8353A@microsoft.com...
> Hi,
> I have read the below help to create a custom <replayDetection> element:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch5_ImpMsgReplayDet_WSE30.asp
>
> But I am confusing about the above custom element and <replayDection> from
> this link:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse/html/1efe87b3-ef59-4d21-9879-b75162a4c821.asp
>
> So, what is the difference between them?
> If I just use the <replayDetection> from the second link, will my web
> service be attacked by replay attacks, is it used for all security token
> type
> (anonymous, username, certificate, kerberos)?
>

"Hung Ngo" <HungNgo@discussions.microsoft.com> wrote in message
news:C26F37EC-4967-4DAF-A7BC-5BAA923EE163@microsoft.com...
> Thank Pablo,
> Can you explain in more details about "Just the token, not the entire
> message" in your reply?
> Hung.
>
> "Pablo Cibraro" wrote:
>
>> The first one is a replay detection mechanism for any kind of message. In
>> other words, it works for all assertions.
>> The second one only prevents replay detection attacks for UsernameTokens.
>> (Just the token, not the entire message).
>>
>> Regards,
>> Pablo Cibraro
>> http://weblogs.asp.net/cibrax
>>
>> "Hung Ngo" <HungNgo@discussions.microsoft.com> wrote in message
>> news:CDAA27AA-71CD-4098-B5CB-E22999F8353A@microsoft.com...
>> > Hi,
>> > I have read the below help to create a custom <replayDetection>
>> > element:
>> > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch5_ImpMsgReplayDet_WSE30.asp
>> >
>> > But I am confusing about the above custom element and <replayDection>
>> > from
>> > this link:
>> > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse/html/1efe87b3-ef59-4d21-9879-b75162a4c821.asp
>> >
>> > So, what is the difference between them?
>> > If I just use the <replayDetection> from the second link, will my web
>> > service be attacked by replay attacks, is it used for all security
>> > token
>> > type
>> > (anonymous, username, certificate, kerberos)?
>> >
>>
>>
>>