Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure.

I'm using the Datatables library as well as jsTree, watermaks and breadcrumbs. Most of this script is to make our site look appealing.

Is there a way to make this secure? Or is it time to move a very lean javascript site?

Thank you for the help!

share|improve this question
2  
Please describe what you mean by "not secure" –  TristanK Feb 1 '12 at 21:40
add comment

2 Answers

up vote 10 down vote accepted

I serve my entire site over https, jquery included.

The trick is to use a CDN for jQuery that supports https, or deploy the code to your own site and include it from your domain. In code, for example:

<script type="text/javascript" 
        src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script>

Works fine and will show up as a secure element.

Now, is that actually secure? Well, I generally trust Google APIs as a CDN and the content I have is not that crucial - however, if I wished to ensure I had total control of the jQuery deployment, I could just host it myself:

<script type="text/javascript" 
        src="https://mysite.com/static/js/jquery.min.js"></script>

Both will work fine. Bottom line: you do not have to deploy jQuery from the CDN, however, if you want to, at least one of them supports https (others may, I looked no further).


An aside to consider - one of the reasons for accessing code from the CDN was to always have the latest version of the jQuery code. Deploying it yourself, you do lose this immediacy - you also gain a slight buffer against breaking updates, although hopefully that shouldn't be an issue.

share|improve this answer
    
Thank you for the help, you are exactly right! This was the issue that I suspected, but for some reason over looked it when debuging... I have no Idea how I missed it. –  James Feb 2 '12 at 3:10
2  
Should also make sure all CSS, pictures and such on the page are also using https src links. –  ewanm89 Feb 2 '12 at 13:32
add comment

Moving to a lean JavaScript site might be a good idea, at least that way you can audit the JavaScript easier and there is a lot less attack area, however you do have to be competent when writing the code.

Which brings me to the other point, what precisely is it with jQuery that isn't secure? Is it just a warning about insecure content on the page, all that means is you aren't loading JavaScript or similar over HTTPS which you should be doing from a copy stored on the server itself, again this way you can audit that copy, finally it might be worth removing any JavaScript classes and functions not actually being used from jQuery (I seriously doubt you are using all of it), we will have to generate a list of all functions called all functions they could call... to do this..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.