AJAX means: "a web page with some code in it -- and I mean it". There is no clear distinction between AJAX and a "normal" page, since normal pages may also have scripting elements in them. AJAX is more a way of stating that you intend to push some parts of your application into the client browser.
A Web-based application runs over the union of the server and the client. It is tempting to have the client do a bit more than just display pages sent by the server, because:
- it increases interface reactivity (user experience is improved);
- it may reduce network load (many GUI-based operations can be performed on the client without talking to the server);
- it may reduce computing load (more work for the client machine, less work for the server).
An analogy can be made with online gaming, e.g. with FPS games. Several users shoot at each other. The server keeps track of where everybody is and who kills who. For such games, interface reactivity is of paramount importance; hence, it is completely unimaginable that the server computes everything, and just sends frames to display to the client. Instead, clients must do the heavy 3D rendering work, and the server simply sends level maps and player position updates.
At that point, security comes into play, because of the fundamental rule:
- From the server point of view, the client is a villain.
In the gaming analogy, this means that the server must trust the client code: for 3D rendering, the client must know the level map and the position of all the other players. It would be easy, for a modified client, to display the map to the player, and pinpoint the other players. Actually, there are many cheaters out there, and game engines use sophisticated code obfuscation techniques to try to deter the majority of cheaters (because cheaters kill the fun, and without the fun the players leave).
This illustrates the thing about AJAX security: since it is code which runs on the client side, whatever it does cannot be trusted by the server, even if the user is duly authenticated (knowing who does it does not make it automatically legitimate). This is usually not a problem for GUI-related interactions -- unless there are security issues about the GUI, such as the "level map display" feature in the gaming analogy. The proper way to analyze security of Web-based applications is to assume that every single byte that the server emits is known the client, and every byte from the client is potentially malicious.
As an rough example, consider SQL injection. One way to avoid SQL injection attacks is to make sure that the data element you plug in your request has no unescaped special character. This validation step MUST be done on the server. You cannot securely do that in AJAX, since whatever AJAX does can be bypassed by the client.