Eric Pascarello interviewed about AJAX security vulnerabilities
Eric Pascarello, the co-author of Ajax in Action, have been interviewed by Colleen Frye at SearchWebServices.com. We have already talked about the MySpace Worm in October, and Eric have answered many question concerned this worm, the need of security for AJAX applications, the server-side validation ...
Ajax is being lauded as a technology to deliver a richer user experience. But does the use of an XMLHttpRequest open up security vulnerabilities?Eric Pascarello: When people look at Ajax they see this XMLHttpRequest object performing magic on a Web page and they think that this can lead to major security flaws. When we do a simple view source on the page, we see the page we are calling, the parameters that are being sent. Anyone with any basic knowledge of JavaScript can easily inject scripts onto the page and change the request object to send other data. So yes, it is open to attack, but it is not anything to be afraid of.
Eric also gives some rules for Ajax Security:
1. If you use user authentication, make sure you check for it on the request page!
2. Check for SQL injections.
3. Check for JavaScript injections.
4. Keep the business logic on the server!
5. Don't assume every request is real!
6. Check the data with validation!
7. Look at the request's header information and make sure it is correct.
Read the Eric Pascarello's interview
Subscribe to AJAX Magazine's feed