Why does Membrane API Gateway return Not a SOAP message?

The wsSecurity plugin can only apply WS-Security to SOAP 1.1 or SOAP 1.2 envelopes. The body is not XML, is empty, has no SOAP Envelope with a Body, or cannot be parsed as XML.

Why do I get a 500 instead of a 400 for Not a SOAP message?

When the error occurs in the response flow, the backend returned a message that is not SOAP. Errors in the response flow are sent to the client as 500.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

Not a SOAP Message: WS-Security Could Not Be Applied

Membrane API Gateway links to this page with the title Not a SOAP message. when the wsSecurity plugin cannot apply WS-Security because the message is not a SOAP message. The detail says whether the request or the response body was affected.

The Error Response

The response contains the title Not a SOAP message., a detail naming the flow, the problem type https://membrane-api.io/problems/user and a link to this page. The type user means that the message, not the gateway, caused the problem. The status depends on the flow:

Flow	Status	Responsible
Request	`400 Bad Request`	Client
Response	`500 Internal Server Error`	Backend

In production mode, the title of the 500 response is replaced by Internal Server Error.

What the WS-Security Plugin Does

The wsSecurity plugin validates and secures SOAP messages: it checks signatures, timestamps and username tokens, decrypts, signs and encrypts. All of this operates on the SOAP envelope, so the plugin first checks that the body is one. Runtime failures during the actual processing are reported under internal/ws-security.

Common Causes

The Body Is Not XML or Does Not Contain a SOAP Body

The detail reads The request body is not XML or does not contain a SOAP body, so WS-Security could not be applied. (or response body). The body is empty, is JSON or text, its root element is not a SOAP 1.1 or SOAP 1.2 Envelope, for example because of a wrong envelope namespace, or the envelope has no Body.

The Body Could Not Be Parsed as XML

The detail reads The request body could not be parsed as XML, so WS-Security could not be applied. The body passed the first check for a SOAP envelope, but is malformed further down in the document.

The Backend Returned No SOAP Message

In the response flow, the backend returned something other than a SOAP envelope, for example an HTML error page or an empty body.

How to Fix It

Client: send a well-formed SOAP 1.1 or 1.2 envelope with a Body.
Operator: in the response flow, check that the backend returns a SOAP envelope.
Operator: place wsSecurity only in APIs or flows that carry SOAP messages, for example inside a request or response flow.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.