Comparing the standard HTML form POST for user authentication vs Javascript/AJAX

Question

Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button?

thus

<form method="POST" action="/login/">
  <input type="hidden" name="csrfToken" value="(...)"/>
  <input type="text" name="username" value="" maxlength="64" autocomplete="off"/>
  <input type="password" name="password" value="" maxlength="1024"/>
  <input type="submit" value="login"/>
</form>

^{example 1: login with HTML-form in pseudo-code}

vs

<form method="POST" action="/login/">
    (... same as above ...)
    <input type="button"/> <!-- will trigger javascript method below -->
</form>

<script type="text/javascript"/>
$.ajax({
    type: "POST",
    url: "/login/",
    data: "(...)", // All form fields
    dataType: "json",
    success: function(data) {
        (...)
    }
});
</script/>

^{example 2: login with ajax in pseudo-code}

This question is only about the javascript/ajax vs html form post, all other things such as TLS, passwords, etc are not my area of interest for this question.

Updated question Added the for field becuase I introduced some confusion by mentioning the csrfToken.

Answer 1

There should be no difference in terms of security, since the POST is handled by the browser in the same way as a form. If you're running HTTPS, it'll go over HTTPS too.

However, keep in mind that complex ajax-based apps are statistically more likely to be vulnerable to XSS than flat HTML pages. This doesn't mean you definitely are, it's just something to watch out for.

Things to consider:

• Ensure that your script is served via HTTPS. You'd be surprised how many people serve their scripts from a CDN over plaintext HTTP.
• Proper cross-domain policy should be specified in crossdomain.xml
• Consider enforcing strict transport security.
• Configure your Content Security Policy properly.
• Avoid eval, escape output using contextual escaping, etc.