Slashdot Mirror

← Back to Stories (view on slashdot.org)

Is Your AJAX App Secure?

Posted by ryuzaki0 on from the something-to-think-about dept.

ShaolinTiger writes "An article looking in detail at some of the security problems with AJAX, how to find them and how to approach them or fix them. Security with AJAX is of course an important consideration as it's asychronous and a malicious user could write data back to your database if implemented incorrectly."

5 of 142 comments (clear)

  1. it's not secure, check out googe maps by Gravis+Zero · · Score: 1, Funny

    AJAX is not secure! if you look at google maps you can see my house... it's just sitting there on the screen waiting to be bombed. ahh.. my frickin' house!

    --
    Anons need not reply. Questions end with a question mark.
  2. Obligatory by frodo+from+middle+ea · · Score: 3, Funny

    I write only static HTML you insensitive clod.

    --
    for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
  3. AJAX App Secure? by digitaldc · · Score: 2, Funny

    If not, you need to clean it up!
    Code cleanliness is next to Dev godliness.

    --
    He who knows best knows how little he knows. - Thomas Jefferson
  4. Tinfoil Response by 0110011001110101 · · Score: 4, Funny
    You sir, are a sucker. I have found a way to beat the dreaded AJAX Google Maps insecurities. Simply put, I have a new house built every couple of years. My current house will be done in a week or so, and according to Google Maps (evil AJAX house bombing helper) my new cul-de-sac does not even exist. It's just a lot of trees... now who would bomb trees?

    Please please please, buy a new house, or next time the Google Spyplane comes to take pictures, teepee your neighborhood with Tinfoil, I'm sure your neighbors will understand once you explain it to them.

    --
    Don't anthropomorphize computers: they hate that.
  5. Re:How is this different by Beryllium+Sphere(tm) · · Score: 2, Funny

    Now, now, be fair.

    The article proposes one kind of attack: "it would leave massive DoS possibilities if I can create an HTML page that, using Javascript, can request thousands of concurrent web-pages from a web-site".

    An attack like that would hit the web server's current directory, ".", like a slasher. An attack site that takes thousands of incoming connections and then floods the victim, implementing this "slash dot" effect, is a brilliant innovation.