How to remove WS-Security tokens from a SOAP message

After you've validated a UsernameToken, or checked an XML Signature, it is often good practice to then strip out the WS-Security blocks containing items like tokens and signatures, before sending them downstream to a Web Service. In some cases, you are stripping these out because you don't want the password to remain in the message. In other cases, you may know that the downstream Web Service will choke on the WS-Security block. It also makes the message smaller.

The Vordel XML Gateway ships with a built-in stylesheet for stripping WS-Security blocks from SOAP messages. You can see this in the Policy Library. Simply apply this to a service, put it into a chain to run after you've processed the WS-Security headers, and voila the headers are gone. Grab a copy of the Vordel Gateway from here: http://www.vordel.com/products/vx_gateway/