Questions tagged [ajax]
AJAX (Asynchronous JavaScript and XML) is a popular technique for creating interactive websites, by providing a concept for data exchange between client and server asynchronously.
11
questions with no upvoted or accepted answers
2
votes
0
answers
974
views
Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?
The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing.
For a State(ful)-scenario (the Synchronizer Token Pattern), they write:
... for AJAX calls it is recommended to add ...
- 133
2
votes
0
answers
209
views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
- 121
2
votes
0
answers
207
views
Suspicious web-application requests containing encoded JavaScript function(?)
I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before.
The raw requests were variations of:
...
- 21
1
vote
0
answers
151
views
Re-populate form with JSON data
I re-populate form with JSON data via javascript (all data has the same origin server)
1 Wen the page load, make a request post ajax
2 The response Ajax is a:
Object { primary_ns: {…}, secondary_ns: {…...
- 41
1
vote
0
answers
189
views
Protecting an api-token with cookie authentication only
I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
- 131
1
vote
0
answers
305
views
Force TLS on mobile app
i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax.
Server's developers asked me to force the call in order that we use TLS ...
0
votes
0
answers
655
views
How this JSON object can be exploitable?
I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side
One of the security recommendation is - Always return JSON with an Object on ...
- 53
0
votes
0
answers
715
views
JWT refresh tokens and Double Submit Cookies
I am struggling to implement JWT refresh tokens with the Double Submit Cookies method.
My current set up for a browser based webapp without refresh tokens looks like this:
Upon successful login, API ...
- 101
0
votes
1
answer
726
views
Sharing oauth2 token with AJAX request to be sent to resource server
I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow.
To explain the scenario I am trying to set up, I have
a client (http://...
0
votes
0
answers
397
views
XSS via Ajax request?
I'm currently honing in on my web exploitation skills and came across this JavaScript function here:
Event.observe(window, 'load', function() {
new Ajax.Request('/dir/dir', {
method: 'post',...
- 101
-1
votes
1
answer
3k
views
PHP/Ajax Data transmission security
I'm learning about web security mechanisms. I have developed the following system
in PHP and JavaScript:
assuming that I have a page named: messages.php which is a real-time chat system.
first when ...
- 34