Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question is inspired by this security question http://security.stackexchange.com/questions/1707

  1. What are the threats in using Ajax? (Please note I am talking about security threats, not features drawbacks)
  2. How do I do Ajax securely? (Please give examples, preferably examples in PHP since I am using the CakePHP framework.)
share|improve this question
add comment

2 Answers

Ajax is just pasing data over HTTP - it's not magic - so you secure it in exactly the same way you do with your normal webpages -

  • check for authentication and authorization
  • Encrypt or add salted hash checks to data exported to the browser for resubmission
  • treat any data received in the request as potentially dangerous
  • use HTTPS where its appropriate
  • transform data leaving your PHP using the right method for were its going (htmlentities, mysql_real_escape_string
  • transform data entering your script using the right method based on its origin (e.g. json_decode)
share|improve this answer
    
if as a logged in user, some actions are executed via ajax, how do we check for authorization? what about CSRF protection? –  Kim Stacks Feb 12 '11 at 10:20
1  
I suggest clarifying that the point is that you can't trust anything that comes from the browser, even if you designed your Ajax to do form validation or whatever. The user may manipulate the javascript at their end, or a MITM may have replaced the scripts entirely. So just do all the same server-side authentication and data checks you normally would. –  nealmcb Feb 18 '11 at 2:02
    
How about a specific code example in any language? for checking authentication? i think i will definitely benefit from that. –  Kim Stacks Feb 20 '11 at 16:10
    
Are there any new problems specific to the way AJAX is done/being used? How do you do security on top of a stateless protocol? –  Marcin Apr 26 '11 at 12:41
    
show 1 more comment

The threats with AJAX are the same that are faced with normal web request: XSS, SQL Injection, etc. One thing to note is that with AJAX, if you load data from a untrusted source (for example some webservice), you should also validate that data on the client, not just on the server, or else someone can potentially inject javascript and other nasty things.

Use the same methods to secure the request as you would use normally, since AJAX is just a HTTP request. But keep in mind that besides checking for the "normal" things (check the users privileges, sanitize the data, etc), also check if he really made the request or if he was tricked (for example a link on another page). To do that, include a CSRF-token in each AJAX request and validate it on the server side (see What is the correct way to implement anti-CSRF form tokens?). Though it is recommended that a CSRF token is used even in normal requests.

Another thing is that depending on what you do with on the client side, also sanitize the data there. Else an attacker could inject harmful code into the page. This is especially important if you get data from a third party, but best do it for all input.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.