Thursday, June 15th, 2006
Corey Benninger of Foundstone has written a paper on Ajax Storage Security (pdf):
I wanted to let you know Foundstone has a white paper on their website about AJAX Storage from a security angle. The paper focuses mainly on where Flash shared objects (used in Dojo), and IE persistence user-data, gets stored on the local system. It mentions and links for tools security auditors can use to view or edit those files. Unlike normal HTTP cookies, these two methods can save larger amounts of data, are not cleared when you empty your browser cache, and with the Flash objects can be accessed across domains and across web browsers.
Programmers of AJAX applications are continually finding innovative ways of reusing older web technologies. We are likely to see more frameworks and technology that allow increased amounts of data to be saved locally and across domains. This includes plans for future Firefox releases to implement a new client side storage capabilities based on the Web Hypertext Application Technology Working Group (WHATWG) Web Applications 1.0 specifications. Having an understanding of how data is stored and how it can be used is important for understanding the complete picture of the security risks involved.
Posted by Dion Almaer at 8:40 am