XWSS (XML Web Services Security Forum) was an independent online community and mailing list for enterprise security architects, software developers, and researchers working with SOAP-based web services and the emerging XML security standards of the early 2000s.
Founded in January 2002, XWSS provided a vendor-neutral space for technical discussion of WS-Security, XML Digital Signatures, XML Encryption, SAML, and related OASIS and W3C specifications. The forum served as a peer review channel where practitioners could share implementation experiences, report interoperability issues, and develop practical security guidance that complemented the formal standards documents.
At its peak in 2003, the forum had 847 registered members and averaged over 40 new posts per day. Contributors included engineers from BEA Systems, IBM, Microsoft, Sun Microsystems, and other enterprise software vendors, as well as independent consultants, academic researchers, and members of the OASIS Web Services Security Technical Committee.
The forum was organized into topical categories covering WS-Security implementation, XML Signature and Encryption, SAML and federation, XML firewalls, SOAP security patterns, standards discussion, vendor interoperability, and general discussion. A curated articles section collected member-contributed technical guides and product evaluations.
XWSS was active during a formative period in web services security. The OASIS WS-Security 1.0 specification was published in April 2002, and the years that followed saw rapid development of supporting standards including the SAML Token Profile, X.509 Token Profile, Username Token Profile, and Rights Expression Token Profile. The forum's discussions tracked this evolution in real time, and several threads contain early analysis of specifications that would later become foundational enterprise standards.
The forum also served as an early warning channel for XML parser vulnerabilities affecting web services deployments. The security advisory threads on entity expansion attacks, external entity resolution, and XPath injection (including discussion of CVE-2002-2344, the BEA WebLogic XML parser denial of service) documented attack vectors that would not receive widespread attention in the broader security community until years later.
While the XML web services landscape has evolved significantly since 2002, the security principles discussed on XWSS remain directly applicable to modern API security. Message-level security, token validation, schema enforcement, and parser hardening are as relevant to REST and GraphQL APIs today as they were to SOAP endpoints two decades ago. Many of the attack vectors first documented on this forum - XML entity expansion, injection through parser differentials, signature wrapping - continue to appear in updated forms in modern vulnerability disclosures.
XWSS continues to publish occasional analysis connecting the foundational concepts from the web services security era to current application security challenges. The original forum discussions are preserved alongside newer content examining how these patterns have evolved.