Are there any Benefits of Ajax Fingerprinting?

Question

I was reading an article on "Web 2.0 Defense with Ajax Fingerprinting and Filtering". The paper emphasis on using Ajax Time stamp header to identify Ajax calls.

// Building request
    http.open("GET", "/ajax-only/headline", true);
    http.setRequestHeader("Ajax-Timestamp",Date())

With the following header attached to the request

Ajax-Timestamp: Tue Oct 24 2006 17:37:46 GMT+0530 (India Standard Time)

I am confused what are the security benefits of identifying Ajax calls from normal requests.

Answer 1

I've read this article a while ago (I think it's about 7 years old), and with all respect to Shreeraj Shah (the author) I completely disagree, and I extend my disagreement to most of his "security" methodology. Security by obscurity isn't the answer!

Here's something taken from the original (IN)SECURE article (page 25) explaining the benefit of this technique

This fingerprinting technique helps in determining the type of client code that has sent this request. It is possible to lockdown resources for just the right client on the server-side as well. This type of header is harder to add by automated crawlers and bots since the logic and calls need to be understood first. Consequently, automated attacks on your Ajax resources can be avoided.

Mr. Shah is assuming that his method adds security because he's leveraging the attacker's ignorance of his request method.

My personal opinion is to treat this as false information, or outdated information at best.

Update:

Now that I think about it a bit more, I think I haven't targeted your exact question

Are there any Benefits of Ajax Fingerprinting?

I don't see any security benefits for that at all. There might be some benefits regarding the usage of the application. One example would be a URL like this

example.com/article/124

You might wanna view the article when the page is visited normally and provide the information in JSON or XML if the same URL was requested with Ajax.