1
vote
1answer
83 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
0
votes
1answer
97 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
2
votes
1answer
116 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
3
votes
1answer
562 views

Access-Control-Allow-Origin wihout AJAX

The post at http://security.stackexchange.com/a/43456/8340 (incorrectly?) states No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer ...
4
votes
3answers
299 views

Using GET to submit username/password? [duplicate]

From what I understand using GET to submit usernames/passwords is a security issue because the username/password are part of the URL which can show up in browser history. Is this still an issue if ...
-2
votes
1answer
207 views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
1
vote
1answer
148 views

Are there any Benefits of Ajax Fingerprinting?

I was reading an article on "Web 2.0 Defense with Ajax Fingerprinting and Filtering". The paper emphasis on using Ajax Time stamp header to identify Ajax calls. // Building request ...
1
vote
1answer
673 views

Picking an encryption algorithm for auth tokens passed via AJAX

I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens. As an example: The user will login in to the website (via OAuth, whether by the site as ...
10
votes
3answers
1k views

Security risks with JSONP?

What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups? If ...
5
votes
4answers
948 views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
15
votes
3answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
14
votes
4answers
2k views

Is AJAX fundamentally insecure?

Possible Duplicate: How to do Ajax securely? At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...