title: Clarification on Web Services architecture
body: <p>Suppose I have an internet facing application. The architecture would be like I have an application server i.e,  the browser and the application talks to each other, the application server in turn talks to the web service provider to fetch the service. The calls between my application (not from the browser) and the web services provider is SOAP. The web services server in turn talks to my real backend server to get the transactions done. Now my doubt here is, since the communication between my application server and web services server is internal/intra, only my application server is facing the internet, is my application safe. What could be the possible attack surface. In this case, I do not need to disclose my wsdl to internet. There is no mutual trust between any of my servers and there is no source validation. Is my application secure since wsdl is not disclosed and the only the app-server is facing internet. </p>
  
  <p>please pardon my style of narrating.</p>