what is Schema (xsd) for? For client or for the service itself?

[kkao77]

I am trying to use schema to validate the data that user sent to my
service. How do I achieve that using schema? Do I give schema to the
client? or do I write my own schema validation inside web service?
How does it work? Thank you.

[olrt]

kkao77 a écrit :

I am trying to use schema to validate the data that user sent to my
service. How do I achieve that using schema? Do I give schema to the
client? or do I write my own schema validation inside web service?
How does it work? Thank you.

Let's suppose that you have to passe some "complex type" in a WebMethod
parameter.
It could be for exemple an XmlDocument type.

It's your responsibility to ensure that the syntax of the XmlDocument
passed in conforms to the syntax you expect.
To be more precise, if you manage both the client-end and the
server-end, you don't have to check the syntax.
In more open scenarios (you manage only the server-end), it's crucial
to check the syntax (for security reasons mostly).

In fact SOAP ensures type checking : suppose your WebMethod expects an
XmlDocument ; if a client calls your method with a parameter of another
type , you'll get a SOAP exception raised by the XmlSerializer on the
server-side.

[kkao77]

Thanks olrt,

So does that mean if I use .net, I don't need to worry abou schema in
this case especially writing webmethod(), it is more useful for people
who prepares xml documents to form those elements and attributes?

I thought I would create schema on server end so the user could
validate some info. once they consume my service. and I was wondering
since they have to create proxy, there is not really xml document to
validate against to, becuase their deserialized xml becomes a class for
them to use and each property has it's own type. Am I right? Thanks
for help.
olrt wrote:

kkao77 a écrit :

I am trying to use schema to validate the data that user sent to my
service. How do I achieve that using schema? Do I give schema to the
client? or do I write my own schema validation inside web service?
How does it work? Thank you.

Let's suppose that you have to passe some "complex type" in a WebMethod
parameter.
It could be for exemple an XmlDocument type.

It's your responsibility to ensure that the syntax of the XmlDocument
passed in conforms to the syntax you expect.
To be more precise, if you manage both the client-end and the
server-end, you don't have to check the syntax.
In more open scenarios (you manage only the server-end), it's crucial
to check the syntax (for security reasons mostly).

In fact SOAP ensures type checking : suppose your WebMethod expects an
XmlDocument ; if a client calls your method with a parameter of another
type , you'll get a SOAP exception raised by the XmlSerializer on the
server-side.

[olrt]

kkao77 a écrit :

Thanks olrt,

So does that mean if I use .net, I don't need to worry abou schema in
this case especially writing webmethod(), it is more useful for people
who prepares xml documents to form those elements and attributes?

I think I hadn't been clear.
If you have total control of both the client and server sides, you
don't need to validate the syntax of the objects on the server since
you have control of the objects'syntax on the client.

I thought I would create schema on server end so the user could
validate some info. once they consume my service. and I was wondering
since they have to create proxy, there is not really xml document to
validate against to, becuase their deserialized xml becomes a class for
them to use and each property has it's own type. Am I right? Thanks
for help.

Be aware that there are only certain types that are WSDL-compatible.
This is the case for primitive types (string, double, etc.) and some
complex types (XmlNode, DataSet).
If the class you expose to client is not WSDL-compatible, you'll have
to make it IXmlSerializable.
But unfortunately this isn't enough.
For example in .NET, wsdl.exe (which can be used to generate a proxy)
generates a DataSet-parametered method for a XmlDocument-derived
parametered Webmethod :-(
So the client will have to edit the proxy code to effectively consume
the exposed class.

See my post "XmlDocument-derived class ..." in this newsgroup that
exposes some issues related to passing a complex-type parameter through
SOAP.

Regards,
Olivier.