Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [ajax]

AJAX (Asynchronous JavaScript and XML) is a popular technique for creating interactive websites, by providing a concept for data exchange between client and server asynchronously.

1
vote
1answer
43 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
2
votes
3answers
118 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
2
votes
2answers
230 views

Why is it important to never use `eval` in conjunction with AJAX?

From OWASP AJAX Security Cheat Sheet: Eval is evil, never use it. Needing to use eval usually indicates a problem in your design. I understand that evaling untrusted JS code can lead to a whole ...
2
votes
2answers
665 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
1
vote
1answer
305 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
0
votes
2answers
7k views

Why Chrome blocks ajax locally?

Could not find dup, so let me know if there is one I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...
2
votes
0answers
121 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
0answers
62 views

Is it inherently insecure to fetch HTML and JS content from server and attach it to an existing HTML node (while executing all scripts)?

Two ways to develop a web app: Either the "classical" way, completely reloading the page with each request, or the "API" way, that is make the server only send JSON data and make the client fetch it ...
5
votes
2answers
1k views

Is an AJAX call less secure than the normal POST method?

I currently have a standard login form like this: <?php if( isset( $_POST['username], $_POST['password'] ) ) { // escape both strings and compare them to database } ?> <form action="" ...
0
votes
1answer
149 views

XSS prevention when inserting HTML without user controlled data into the DOM?

I have some JavaScript that fetches some HTML from a PHP script, and inserts it into the DOM: $.get("/includes/blocks.php",{ id:encodeURIComponent(id) }).done(function(Data){ $('<div class="...
0
votes
1answer
538 views

jQuery $.get HTML code and XSS

JS code var id = $(this).data("id"); $.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){ $('<div>'+data+'</div>').appendTo('.parent'); }); api.php: echo json_encode('&...
1
vote
0answers
95 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
2
votes
3answers
428 views

How do I prevent XSS in direct access to AJAX/JSON APIs?

In my rich client, I escape user-provided data before rendering to prevent XSS. The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I ...
1
vote
1answer
606 views

Django, ajax and HttpOnly cookies

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs: CSRF_COOKIE_HTTPONLY = ...
0
votes
1answer
566 views

Intercepting with Burp does not work - alternative ways

When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get ...
0
votes
4answers
121 views

Protecting from console attacks

I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
0
votes
1answer
910 views

How can I prevent requests from the browser console while still using ajax? [duplicate]

I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request ...
1
vote
1answer
468 views

Is it secure to reuse CSRF token from existing cookie (for a new tab in browser)?

We have a system that does async request to backend to get CSRF (via AJAX). The response from the server is a new cookie and a header that we remember in javascript and use later. It all works fine ...
0
votes
1answer
62 views

HMAC API exposed through public site?

(I also asked this question over on StackOverflow.) What steps can I take to prevent unauthorised access to a method on an unauthenticated controller? Background The diagram below illustrates a ...
1
vote
2answers
996 views

Is CSRF protection useless with AJAX?

I've asked a question regarding an ASP.NET WebAPI implementation of CSRF protection: https://stackoverflow.com/questions/45389512/the-anti-forgery-cookie-token-and-form-field-token-do-not-match-when-...
1
vote
2answers
3k views

Requesting CSRF token via AJAX for JavaScript webapp [duplicate]

I have a JavaScript web application that communicates with an API on a different subdomain. The HTML and Javascript are all hosted in S3. A conventional CSRF token is put into the body of the HTML ...
6
votes
3answers
5k views

How does CSRF correlate with Same Origin Policy

I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
3
votes
1answer
382 views

What does Same-origin policy apply to?

Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy. Are there other things that use the ...
1
vote
1answer
3k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
3
votes
1answer
6k views

Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?

I am testing a scenario with Burp proxy. I am located on a website https://website.com/web There's an option there to delete an item, when you click it , a certain POST request is sent (...
2
votes
1answer
746 views

XSS from JSON outputs

In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes: The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the ...
2
votes
2answers
373 views

Does appending data from a form to a URL with encodeURIComponent safely sanitize user input?

In my web app, I want to send a cross-domain AJAX request to another site. I want to take the text that the user enters in a form and append that text to the query string in the URL I send the request ...
1
vote
1answer
55 views

How to securely send cookies from one site to another via userscript?

I am part way through creating a 3rd party service for an online game. Currently to pull the game data from outside the game I use my own auth cookies, however, I want to make this available for other ...
0
votes
1answer
251 views

PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider

Say on the guest checkout page of an e-commerce website, if the user enters the delivery address, payment details (Credit card details) and clicks Submit button - and if an ajax request is made to ...
3
votes
2answers
3k views

document.cookie and its scope

There is some basic confusion that I have. A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the ...
0
votes
2answers
296 views

Is storing a user's IP address, in their browser, a security concern?

I need to get the users IP address on the server. For technical reasons it's a lot easier for me to just pass it in from the client in the form of a query string. So, on page load I would store their ...
0
votes
1answer
101 views

How to GET security answer values via AJAX for user edit

I have an issue where our app had an app scan issue. The application is using GET to retrieve info for a user profile page (written in HTML/Javascript). This page has the user's security questions ...
1
vote
3answers
1k views

Is HTTP POST any more secure than HTTP GET for AJAX?

All considerations of HTTPS/SSL, etc aside, if my user fills out a form and I send it by AJAX, it seems to me that POST & GET are equally interceptible, although GET is a teensy bit more ...
2
votes
2answers
924 views

Using browser AJAX to initiate credit card transaction with processor?

Let's say that I have a website where people can make purchases, donations, etc. The entire website is served with https. I store the information regarding the purchases (item, quantity, price) as ...
0
votes
2answers
2k views

exploiting CSRF in ajax request via XSS flaw

In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight ...
2
votes
2answers
3k views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
4
votes
3answers
2k views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
0
votes
2answers
318 views

What are the possible security issues when making a checkout system in Javascript?

I'm pretty new to JS and I am currently making a simple step-wise checkout system using purely JS and some Ajax and PHP. I have been wondering about the possible security issues that might pose with ...
2
votes
2answers
165 views

Is it safe to reveal table column names in ajax?

I have a table like... THINGS_TABLE ============ thing_key int PRIMARY KEY thing_num varchar(20) thing_title varchar(20) thing_description varchar(20) And ...
4
votes
1answer
379 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
1
vote
2answers
741 views

Can F5's Big-IP ASM protect against CSRF for AJAX calls?

I know that F5's Big-Ip ASM offers protection against CSRF regarding links and forms. However, when it comes to AJAX calls their documentation is somewhat ambiguous. I understand that they DO NOT ...
1
vote
3answers
3k views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
3
votes
1answer
620 views

Is this vulnerable to XSS exploit?

A typical ajax call: $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", success: function(response) { $("#id").html(response); }, }); sends a ...
7
votes
1answer
2k views

Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)

I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX. Related to the protection against CSRF I have encountered the problem of ...
2
votes
2answers
314 views

Is this vulnerable to an insecure URL redirection attack

I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the ...
4
votes
1answer
565 views

XSS through modifying a UI element value?

I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so: var displ="<h1>"+$( "#myslider" ).slider(...
1
vote
2answers
583 views

Javascript/Ajax Hijacking

I was wondering if below GET requests from a HTML file and a javascript file, are vulnerable to AJAX Hijacking/JavaScript Hijacking? AJAX Hijacking: http://haacked.com/archive/2009/06/25/json-...
0
votes
1answer
324 views

Does custom header for CSRF protection invalidate CSRF protection

A penetration testing is ordered on one of the web sites. I have implemented OWASP CSRF Guard on the web site. It uses custom headers for CSRF protection for AJAX. This got flagged with subject ...
1
vote
1answer
2k views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
14
votes
1answer
34k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...