web services - Are SOAP Security headers "per connection"? -

i know little soap theory , need help.
imagine web service , client. there gateway (facing internet), requests have relayed through.
client authenticates gateway using client certificate (transport security).
gateway, in turn, uses message credentials authenticate web service.

my question: reasonable gateway, after getting response web service, forwards security header client?

i'm thinking "feels" should gw -> web service link only, since client didn't use message security in request right or wrong?

you're talking 3 different layers of network stack. whether encrypt transport https has absolutely nothing whether or not wish protect message payload ws-i security.

two articles on ws-security (at least microsoft/.net perspective):

• http://msdn.microsoft.com/en-us/library/ms788756%28v=vs.110%29.aspx

• http://msdn.microsoft.com/en-us/library/ms977327.aspx

in answer question: if have soap security header, are using ws-security, , client is passing web service link. typically, transparent both client code , server code; it's handled "middleware" in .net libraries.