In addition, it describes how to attach security tokens, including binary security tokens such as X.509 certificates and Kerberos tickets, to messages.WS-Security incorporates security features in the header of a SOAP message, working in the application layer.