0

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties software such as Postman (I believe). However, if I use an HTTPS connection, will this be prevented?

If this isn't secure, however, what are solutions to transfer javascript data to PHP securely?

Thank you

1
  • 1
    Postman is typically running on the same computer as the browser/client. You typically can't prevent this, just like you cant prevent the user from hitting F12 to open up developer tools locally on their browser. HTTPS protects the data in transit from client to server, not locally.
    – hft
    Jan 18 at 0:06

1 Answer 1

2

This is not a javascript, POST or HTTPS problem, it affects all data received by a web server. Although realizing that someone might edit a URL might be easier to realize that cookies and other HTTP request headers cannot be trusted.

You cannot prevent the data from being manipulated, an attacker could use an intercepting proxy such as burp or fiddler, the browser developer tools. Or even manually construct the request using curl or while fiddly I sometimes do something like this:

echo -ne 'POST /uri HTTP/1.1\r\nHost: hostname.com\r\nContent-Type: application/json\r\n\r\n{"key":"value"}\r\n\r\n' | \
openssl s_client -connect hostname.com:443

This is why web application security often focuses quite heavily on input validation. Such as the OWASP proactive controls: https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs

Validating the data server side can be tricky, but as you cannot trust the data you receive there aren't many other options. In addition to validating the data you'll also need to ensure you handle it in context safe ways, like using parameterized database queries and encoding html characters in page output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.