1

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?

  • 2
    Potentially you could just use one single web page for your entire website and use ajax to serve different content to the user... potentially. – hownowbrowncow Jun 29 '15 at 20:52
  • 1
    AJAX logic is performed on the client-side, which is a bad place for security. PHP is executed server-side. – schroeder Jun 29 '15 at 21:50
  • I've read that if AJAX is correctly aplied is almost as secure as PHP, is that false? Is ajax fundamentally insecure? | stackexchange.com – jogan Jun 29 '15 at 22:30
  • Depends on the task. Can't use it for authentication or whenever else a lying client would cause problems. Using it for basic data processing is fine. – Natanael Jun 30 '15 at 8:25
  • @Natanael Are you perhaps confusing JavaScript with AJAX? AJAX is just another means of making a request to the server. Doesn't matter if the client lies as long as the server doesn't trust the client. I don't see how the request being made with AJAX changes that at all. The client can lie using a regular form submission just as easily as it can through an AJAX request. – Ajedi32 Jul 2 '15 at 13:49
4

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?

Ajax is not a special thing regarding the transport of the login data, because it is a HTTP request done in the background instead of the foreground. Thus if done correctly the security should be the same.

But, with a normal foreground HTTP request you update the full page and thus take the current browser tab fully into a different security level (i.e. logged in vs. logged out). With Ajax you update only part of this page. If you are not careful you might mix this way content from different security levels on the same page so that data from different security realms might interact with each other.

Thus using a new page instead of updating an existing page is not only the more simple approach but also the one where it is easier to verify that everything was done correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.