3

In my website I'm using an ajax call to get some information from the backend. Even if I'm using SSL someone can intercept the call and replace the real response with a fake one. Is there a way to be sure that nobody changed the content of the response?

1
  • 7
    SSL/TLS has built-in integrity checking. Can you provide a link that supports "Even if I'm using SSL someone can intercept the call and replace the real response with a fake one" ?
    – RoraΖ
    Oct 3, 2014 at 11:14

1 Answer 1

2

I think you are trying to solve the wrong problem. The main issues with Ajax requests is not the integrity of data, but XSS(cross site scripting), CSRF (cross site request forgery), and authentication bypass.

If you are properly using SSL (not accepting self signed certificates, invalid certificates, and so), you can be sure that nobody can intercept and modify the data. Nobody can, except the government.

You must be sure that Ajax requests obey the authentication framework you have in place. So, try to access it directly without the frontend, save sessions and try to replay them, and catalog all the answers. You must be sure that invalid or unexpected input don't show undesirable data to the attacker.

You must be sure that all user supplied data is properly sanitized before being processed or echoed back. Failure to sanitize data can lead to XSS, SQL injections, local and remote file inclusion, and a host of other problems.

And must be sure that every request is protected against cross site requests, by implementing anti-CSRF tags. Ignoring it can expose your users to some problems, like account takeover, fraudulent requests, and so.

SSL infrastructure is very good, but all the layers above it are much more problematic. People writing SSL software are hardened professionals, but you can find lots and lots of inexperienced developers writing PHP, SQL and Javascript code those days.

6
  • 1
    +1 for the last paragraph. I would comment that people developing for well defined SSL tools are hardened professionals. People still try to role their own SSL implementations. Few and far between, but they're there.
    – RoraΖ
    Oct 3, 2014 at 14:32
  • Maybe there is something that i ignore but....you said "If you are using SSL, you can be sure that nobody can intercept and modify the data. Nobody can, except the government." But this is no true. You can use a proxy with a rewrite rule (like Charles for example) and create a specific response for the client. Of course your client must trust the charles ssl certificate.
    – Ignazio
    Oct 3, 2014 at 15:07
  • This of course means that the new response is signed with a different certificate, but for usual ajax code this is not a problem.
    – Ignazio
    Oct 3, 2014 at 15:09
  • THanks. I edited the answer to add "proper SSL". If you disable the SSL protections, you are not covered by it. Allowing a invalid certificate to be accepted invalidates the protection.
    – ThoriumBR
    Oct 3, 2014 at 15:11
  • 1
    SSL protection depends on the user's settings so i cannot rely on that. I agree that maybe the problem is wrong. I cannot rely on what i receive from the backend for doing something special on the client, because my client can runs in an "unprotected" area.
    – Ignazio
    Oct 3, 2014 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .