AJAX (Asynchronous JavaScript and XML) is a popular technique for creating interactive websites, by providing a concept for data exchange between client and server asynchronously.

learn more… | top users | synonyms

50
votes
6answers
7k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
19
votes
3answers
8k views

Security risks with JSONP?

What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups? If ...
17
votes
3answers
3k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses same-...
14
votes
4answers
6k views

Is AJAX fundamentally insecure?

Possible Duplicate: How to do Ajax securely? At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
14
votes
2answers
6k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
9
votes
1answer
935 views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
9
votes
2answers
5k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
8
votes
1answer
7k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
8
votes
1answer
3k views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
7
votes
3answers
10k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...
7
votes
1answer
2k views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
7
votes
1answer
976 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
7
votes
2answers
1k views

CSRF protection for AJAX when using multiple browser tabs

Say I've got that web application that has a CSRF protection according to the Synchronizer Token Pattern. The server expects a valid CSRF token in each POST request when the user is authenticated. Now ...
6
votes
2answers
3k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
6
votes
1answer
314 views

Alternative to anti-CSRF tokens for AJAX request (Same Origin Policy)

I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX. Related to the protection against CSRF I have encountered the problem of ...
6
votes
2answers
5k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
6
votes
4answers
2k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
5
votes
1answer
6k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
5
votes
1answer
1k views

Is one CSRF token per session is adequate with HTTPS?

Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
5
votes
2answers
1k views

Ajax and CSRF protection

Without going into too much details I have a site which is 100% Ajax. All requests to the site (both GET and POST) are done via Ajax. Now I have to implement CSRF protection, and all the solutions I ...
4
votes
4answers
8k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
4
votes
4answers
504 views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
4
votes
3answers
752 views

Using GET to submit username/password? [duplicate]

From what I understand using GET to submit usernames/passwords is a security issue because the username/password are part of the URL which can show up in browser history. Is this still an issue if ...
4
votes
1answer
2k views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
4
votes
1answer
110 views

XSS through modifying a UI element value?

I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so: var displ="<h1>"+$( "#myslider" ).slider(...
4
votes
1answer
280 views

Finding all AJAX entrypoints

Is there any tool to (automatically) find all backend JavaScript entrypoints within a site? I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
3
votes
3answers
8k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header (...
3
votes
4answers
2k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
3
votes
3answers
215 views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
3
votes
1answer
80 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
3
votes
1answer
119 views

Is this vulnerable to XSS exploit?

A typical ajax call: $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", success: function(response) { $("#id").html(response); }, }); sends a ...
3
votes
1answer
1k views

Access-Control-Allow-Origin wihout AJAX

This answer (incorrectly?) states No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via ...
2
votes
4answers
925 views

Analyze my custom web authentication scheme, based on a token derived from username and password

To avoid having the user to login every time his session expires, I want to implement a token based authentication system. My scheme works like this: Send the user login (send name + password) ...
2
votes
4answers
413 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
2
votes
2answers
88 views

Using browser AJAX to initiate credit card transaction with processor?

Let's say that I have a website where people can make purchases, donations, etc. The entire website is served with https. I store the information regarding the purchases (item, quantity, price) as ...
2
votes
3answers
8k views

Set Cookie in XHR response : How different browsers handle this?

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this? Does any version of any browser set the cookie for example....
2
votes
2answers
69 views

Is it safe to reveal table column names in ajax?

I have a table like... THINGS_TABLE ============ thing_key int PRIMARY KEY thing_num varchar(20) thing_title varchar(20) thing_description varchar(20) And ...
2
votes
2answers
7k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
2
votes
2answers
138 views

Is this vulnerable to an insecure URL redirection attack

I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the ...
2
votes
1answer
956 views

How to secure my ajax call to the backend?

In my website I'm using an ajax call to get some information from the backend. Even if I'm using SSL someone can intercept the call and replace the real response with a fake one. Is there a way to be ...
2
votes
1answer
590 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
2
votes
4answers
2k views

Intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
2
votes
1answer
1k views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
2
votes
0answers
105 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
1
vote
2answers
526 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
1
vote
3answers
98 views

Is HTTP POST any more secure than HTTP GET for AJAX?

All considerations of HTTPS/SSL, etc aside, if my user fills out a form and I send it by AJAX, it seems to me that POST & GET are equally interceptible, although GET is a teensy bit more ...
1
vote
2answers
164 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
1
vote
1answer
383 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
1
vote
1answer
190 views

Are there any Benefits of Ajax Fingerprinting?

I was reading an article on "Web 2.0 Defense with Ajax Fingerprinting and Filtering". The paper emphasis on using Ajax Time stamp header to identify Ajax calls. // Building request http.open("GET"...
1
vote
2answers
190 views

Can F5's Big-IP ASM protect against CSRF for AJAX calls?

I know that F5's Big-Ip ASM offers protection against CSRF regarding links and forms. However, when it comes to AJAX calls their documentation is somewhat ambiguous. I understand that they DO NOT ...