Questions tagged [ajax]

AJAX (Asynchronous JavaScript and XML) is a popular technique for creating interactive websites, by providing a concept for data exchange between client and server asynchronously.

Filter by
Sorted by
Tagged with
0
votes
1answer
115 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
0
votes
1answer
149 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
0
votes
1answer
52 views

Reverse-proxy issues

I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
1
vote
2answers
97 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
0
votes
0answers
290 views

JWT refresh tokens and Double Submit Cookies

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...
0
votes
1answer
111 views

Sharing oauth2 token with AJAX request to be sent to resource server

I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow. To explain the scenario I am trying to set up, I have a client (http://...
2
votes
3answers
80 views

Stop User Enumeration requests on AJAX endpoints

I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
0
votes
0answers
102 views

XSS via Ajax request?

I'm currently honing in on my web exploitation skills and came across this JavaScript function here: Event.observe(window, 'load', function() { new Ajax.Request('/dir/dir', { method: 'post',...
0
votes
1answer
70 views

How To Validate Secure Traffic from Chrome with Element To Matrix.org on Linux

Are you familiar with the Element chat system of https://app.element.io ? Are you familiar with its connections to Matrix.org (for a free account)? Is there a way that I can sniff this traffic on the ...
1
vote
2answers
73 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
0
votes
1answer
2k views

How to prevent Cross-site Scripting in ajax response

I have a page(parent.php) from where i am calling a another page(result.php) through jquery ajax that is returning a response in html format. This response is showed on the parent.php page in a div. ...
1
vote
1answer
185 views

Can somebody explain why the IP address 192.168.1.1 is apparently "special" and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
1
vote
1answer
95 views

Does the HTML password field include any protection against XHR/AJAX exfiltration?

In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies? This is relevant in case we have to deal with script ...
2
votes
1answer
109 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
0
votes
1answer
153 views

Is it possible to exfiltrate a router config file to server using csrf ajax?

the curl commend used to download the file curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
2
votes
0answers
422 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
0
votes
1answer
184 views

Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved?

I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents ...
-1
votes
2answers
115 views

Why do so many websites use third-party sites for hosting JavaScripts?

Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
3
votes
1answer
576 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
2
votes
3answers
855 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
2
votes
2answers
1k views

Why is it important to never use `eval` in conjunction with AJAX?

From OWASP AJAX Security Cheat Sheet: Eval is evil, never use it. Needing to use eval usually indicates a problem in your design. I understand that evaling untrusted JS code can lead to a whole ...
2
votes
2answers
4k views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
1
vote
2answers
2k views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
2
votes
2answers
31k views

Why Chrome blocks ajax locally?

Could not find dup, so let me know if there is one I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...
2
votes
0answers
158 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
6
votes
2answers
2k views

Is an AJAX call less secure than the normal POST method?

I currently have a standard login form like this: <?php if( isset( $_POST['username], $_POST['password'] ) ) { // escape both strings and compare them to database } ?> <form action="" ...
0
votes
1answer
296 views

XSS prevention when inserting HTML without user controlled data into the DOM?

I have some JavaScript that fetches some HTML from a PHP script, and inserts it into the DOM: $.get("/includes/blocks.php",{ id:encodeURIComponent(id) }).done(function(Data){ $('<div class="...
1
vote
1answer
1k views

jQuery $.get HTML code and XSS

JS code var id = $(this).data("id"); $.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){ $('<div>'+data+'</div>').appendTo('.parent'); }); api.php: echo json_encode('&...
1
vote
0answers
134 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
2
votes
3answers
752 views

How do I prevent XSS in direct access to AJAX/JSON APIs?

In my rich client, I escape user-provided data before rendering to prevent XSS. The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I ...
2
votes
1answer
2k views

Django, ajax and HttpOnly cookies

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs: CSRF_COOKIE_HTTPONLY = ...
0
votes
1answer
1k views

Intercepting with Burp does not work - alternative ways

When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get ...
0
votes
4answers
306 views

Protecting from console attacks

I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
0
votes
1answer
2k views

How can I prevent requests from the browser console while still using ajax? [duplicate]

I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request ...
1
vote
1answer
908 views

Is it secure to reuse CSRF token from existing cookie (for a new tab in browser)?

We have a system that does async request to backend to get CSRF (via AJAX). The response from the server is a new cookie and a header that we remember in javascript and use later. It all works fine ...
0
votes
1answer
99 views

HMAC API exposed through public site?

(I also asked this question over on StackOverflow.) What steps can I take to prevent unauthorised access to a method on an unauthenticated controller? Background The diagram below illustrates a ...
1
vote
2answers
3k views

Is CSRF protection useless with AJAX?

I've asked a question regarding an ASP.NET WebAPI implementation of CSRF protection: https://stackoverflow.com/questions/45389512/the-anti-forgery-cookie-token-and-form-field-token-do-not-match-when-...
1
vote
2answers
4k views

Requesting CSRF token via AJAX for JavaScript webapp [duplicate]

I have a JavaScript web application that communicates with an API on a different subdomain. The HTML and Javascript are all hosted in S3. A conventional CSRF token is put into the body of the HTML ...
15
votes
3answers
15k views

How does CSRF correlate with Same Origin Policy

I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
2
votes
1answer
598 views

What does Same-origin policy apply to?

Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy. Are there other things that use the ...
1
vote
1answer
7k views

No Preflight Request is made during XHR cross-origin request

I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server. var xhr = new XMLHttpRequest(); xhr.open("GET", "https://www.facebook.com/favicon.ico", true); xhr....
4
votes
1answer
16k views

Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?

I am testing a scenario with Burp proxy. I am located on a website https://website.com/web There's an option there to delete an item, when you click it , a certain POST request is sent (...
2
votes
1answer
859 views

XSS from JSON outputs

In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes: The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the ...
2
votes
2answers
1k views

Does appending data from a form to a URL with encodeURIComponent safely sanitize user input?

In my web app, I want to send a cross-domain AJAX request to another site. I want to take the text that the user enters in a form and append that text to the query string in the URL I send the request ...
1
vote
1answer
100 views

How to securely send cookies from one site to another via userscript?

I am part way through creating a 3rd party service for an online game. Currently to pull the game data from outside the game I use my own auth cookies, however, I want to make this available for other ...
0
votes
1answer
396 views

PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider

Say on the guest checkout page of an e-commerce website, if the user enters the delivery address, payment details (Credit card details) and clicks Submit button - and if an ajax request is made to ...
3
votes
2answers
3k views

document.cookie and its scope

There is some basic confusion that I have. A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the ...
0
votes
2answers
365 views

Is storing a user's IP address, in their browser, a security concern?

I need to get the users IP address on the server. For technical reasons it's a lot easier for me to just pass it in from the client in the form of a query string. So, on page load I would store their ...
0
votes
1answer
130 views

How to GET security answer values via AJAX for user edit

I have an issue where our app had an app scan issue. The application is using GET to retrieve info for a user profile page (written in HTML/Javascript). This page has the user's security questions ...
2
votes
3answers
2k views

Is HTTP POST any more secure than HTTP GET for AJAX?

All considerations of HTTPS/SSL, etc aside, if my user fills out a form and I send it by AJAX, it seems to me that POST & GET are equally interceptible, although GET is a teensy bit more ...