How about a concrete example using WS-Security UsernameToken profile

I can’t remember if i saw something like this somewhere else before…So here’s something to chew on. Some cut-n-paste from the Pownce site.

HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.27 (Unix) (Red-Hat/Linux)
Content-Length: 438 Connection: close
Content-Type: text/html; charset=UTF-8
Security-Signature: type=UsernameToken; Username="clint"; PasswordDigest="ztx+laokpMlpZaWtnOa57k8MzIQ="; Nonce="KjsaeiuDFKJEwkr4332rL="; Created="2007-07-16T21:35:50Z";

Accept-Signature is a tip from James’ #4 bullet point.

GET /index.html HTTP/1.1
Host: www.example.com
Accept-Signature: UsernameToken