Our first release of the Universal Thread Web Service was using SOAP header for the manipulation of the authentication scheme. As some of you may have found by reading several documents on the Web which negotiate with that, there are several reasons why doing it like that.

First of all, we do not want the user to submit the authentication for every method call by the use of two additional parameters. This is an approach we have eliminated since a while. Parameters being passed should relate to the method itself and that's about what it should be.

Using manipulation of the SOAP header has a disadvantage. It requires the client to setup the proper implementation in order to do so. Thus, we have to provide samples and support that aspect as well. This is something we would like to avoid. Samples are provided in Visual FoxPro thus someone who would like to use our Web Service from VBScript, for example, would have a rough time to make it work.

Microsoft, form what they said on several documentation I have read seems to work hard on adding that capability builtin the protocol in order to avoid doing such implementation. But, for now, it's not that ready.

I have found some documentation that mentions that Cookie-Based authentication is supported in ASP.Net as oppose to SOAP Toolkit 2.0.

Can someone bring some additional info on that?

Of course, building the Web Service in Visual FoxPro would be better for me as I can do it in 5 minutes. The data handling is not a factor as our Web Service is only a business object. So, if .Net is capable of doing that, I would consider it. Basically, if in order to make an authentication mecanism work, without having the client to support a SOAP header by code in .Net is doable, I'll just build the Web Service in .Net instead of SOAP Toolkit 2.0. The most important part is just to have the user to instantiate the Web Service and to assign two properties for the authentication. Let me know if .Net by the use of ASP.Net, for example, is capable of doing that, as per what is said on Microsoft site about the ability for ASP.Net to support Cookie-based authentication.