Wednesday, January 10, 2007

AJAX Security Concerns

Recently, I read a well done article about security concerns, and recommendations for securing Web application development, especially AJAX applications.

Since Ajax Web applications exist on both the client and the server, they include the following security issues:
  • Create a larger attack surface with many more inputs to secure
  • Expose internal functions of the Web application server
  • Allow a client-side script to access third-party resources with no builtin security mechanisms

AJAX implementations require a trust relationship between the client and server — a relationship that can be exploited by an attacker...

The JavaScript in the Ajax engine traps the user commands and makes function calls in clear text to the server. Browser requests and Ajax engine requests look identical. The server is incapable of discerning a request made by JavaScript and a request made in response to a user action. This fact means it is very difficult for an individual to prove that they did not do a certain action.

It also means that JavaScript can make a request for a resource using Ajax that occurs in the background without the user’s knowledge. The browser will automatically add the necessary authentication or state-keeping information such as cookies to the request. JavaScript code can then access the response to this hidden request and then send more requests. This expansion of JavaScript functionality increases the possible damage of a Cross-Site Scripting (XSS) attack.

Read the whole, excellent Article "AJAX Security Dangers" by Bill Hoffmann.

11 comments:

Anonymous said...

You know ,I have some flyff penya,and my friend also has some
flyff money,do you kouw they have the same meaning,Both of them can be called flyff gold,I just want to
buy flyff penya,because there are many
cheap penya

Anonymous said...

You know ,I have some maple mesos,and my friend also has some mesos,do you kouw they have the same meaning,Both of them can be called maplestory mesos,I just want to
buy flyff penya ,because there are many
cheap mesos

Anonymous said...

aion chinaaion china gold,
aion cn goldaion chinese gold,
aion gold chinaaion gold chinese,
china aion goldchinese aion gold,
aion china kinaaion chinese kina,
aion kina chinachina aion kina,
aion china buybuy aion china,
aion chinese server goldaion cn server gold,
aion china server goldchina aion server gold,
chinese aion server goldaion chinese server gold,
aion cn server kinaaion china server kina,
china aion server kinachinese aion server kina

requiem online gold said...

Now do you worried about that in the game do not had enough second life linden to play the game, now you can not worried, my friend told me a website, in here you can buy a lot linden dollars and only spend a little money, do not hesitate, it was really, in here we had much secondlife money, we can sure that you will get the cheap linden, quick to come here to buy lindens.

Now do you worried about that in the game do not had enough requiem gold to play the game, now you can not worried, my friend told me a website, in here you can buy a lot requiem lant and only spend a little money, do not hesitate, it was really, in here we had much requiem money, we can sure that you will get the cheap requiem lant, quick to come here to buy requiem online gold.

Anonymous said...

cheap wedding gowns,
discount bridal gowns,
China wedding dresses,
discount designer wedding dresses,
China wedding online store,
plus size wedding dresses,
cheap informal wedding dresses,
junior bridesmaid dresses,
cheap bridesmaid dresses,
maternity bridesmaid dresses,
discount flower girl gowns,
cheap prom dresses,
party dresses,
evening dresses,
mother of the bride dresses,
special occasion dresses,
cheap quinceanera dresses,
hot red wedding dresses

products said...

China Wholesalers has been described as the world’s factory. buy products wholesaleThis phenomenom is typified by the rise ofbusiness. Incredible range of products available with China Wholesale “Low Price and High Quality” not only reaches directly to their target clients worldwide but also ensures that wholesale from china from China means margins you cannot find elsewhere and China Wholesale will skyroket your profits.china wholesale productsbuy china wholesalewholesale chinawholesale productsbuy products

products said...

We offer designer , custom wedding dress, cheap cell phonescheap wedding dressesbridal gowns, wedding gowns, Flower Girl Dresses andwholesale cell phonesso on. Buy tailor-made anddesigner wedding dresses designer to be a special brides now!

products said...

Wholesale Gemstone cheap Gemstone Jewelry from China, discount wholesale jewelry Beads, wholesale Gemstone jewelry cheapest Wholesale Naruto anime and manga cheap cosplay costumes, cheap Naruto cosplay costumes on sale, buy Naruto cosplay naruto online shop.Wholesale anime and manga wholesale crystal jewelry costumes, cheap cosplay costumes on sale, buy anime cosplay costumes online shop

bike arenal said...

Costa rica tours, shopping online, costa rica fishing, jaco fishing charters, costa rica whale watching, costa rica dolphin watching, costa rica party boat, panama fishing, fishing costa rica los suenos, los suenos fishing charters, costa rica fishing los suenos, los suenos costa rica fishing, costa rica los suenos fishing, fishing costa rica los suenos, los suenos fishing charters, costa rica fishing los suenos, los suenos costa rica fishing charters, costa rica los suenos fishing, Los suenos fishing, Fishing costa rica los suenos, Costa Rica Rafting,
http://www.kingtours.com/.

Ephesus said...

I loved every moment of our tour. Istanbul, cappadocia and ephesus are fantastic city. We saw so many historical places and guide was very informative. We definitely recommend it. http://www.packagetoursturkey.com - http://www.touroperatoristanbul.com We visited Istanbul for the first time on your tour turkey tours we are from Cappadocia tours Greece and we just loved it! istanbul tours We finally were able to see sights that we had only heard from our friends who visited I have to say that this trip was fantastic. I had a great time in Turkey. Everything went on very well actually much better than we expected istanbul travel Our guide was very friendly and ephesus tours he knew all details of history. Thanks for everything.

istanbul said...

TTG Travel Agency is a leading travel agency and tour operator in istanbul Turkey with more than seven years of professional travel service. Because of our dedication and commitment to your needs istanbul travel we are able to offer you better quality of service at lower prices than other operators. http://www.istanbulhotels.com We provide hundreds of elaborately pre-designed Turkey tour packages, Turkey tours discounted, Guided turkey hotels and Turkey Tours, and we also provide customized travel service that is organized according to your specific needs and requirements http://www.istanbulhotels.com Our tours are professionally guided, intimate, and safe.