Is there any rule that says when SOAPAction is REQUIRED in the setRequestHeader?

Question

Is there any rule that says when SOAPAction is REQUIRED in the setRequestHeader?

In my jQuery library (SPServices), I've been including the SOAPAction for every Web Service call. It turns out that is what is preventing anonymous access to the Web Services to work. When I remove SOAPAction entirely and I AM logged in, some calls fail with the following error:

errorstring: The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again. 
errorcode: 0x8102006d

I suppose that it could be as simple as operations which read vs. operations which write, but I figured I'd toss it out there for ideas.

M.

UPDATE: @cwheeler76 pointed out this article from Jan Tielens: The security validation for this page is invalid" when calling the SharePoint Web Services. It also describes the problem and the solution using SOAPAction. I'm looking for more the 'when' as opposed to the 'how'.

Answer 1

Well, no one else had an answer, so I think I figured it out for myself. I'm going to mark my own answer here as the right one and see if I can push my points from 998 over 1000. UPDATE: Damn. I have to wait 12 hours to be a greedy point grabber and mark my own post as the answer.

The full answer and how I got to it is in my blog post entitled Allowing Anonymous Access with SharePoint Web Services and SPServices, but here's the meat of it:

It turns out that you don't need to pass the SOAPHeader if the Web Service operation is a read-only one. For instance, some of the most useful things, like GetListItems, don't require it. In my testing, none of the read-only operations need the SOAPHeader. Oddly, if you don't pass it with the read/write functions, they only fail if you are authenticated, the error says that you aren't authenticated, and that you should hit the back button and refresh. Well that's hardly helpful given that you aren't working interactively, but talking to the Web Services programmatically.