what people are missing is that we’re still dealing with plain jane http here, nothings really changed.

AJAX web-apps seem to be as secure as the ASP/PHP you build it on.

If you know how to manage ASP/PHP sessions properly and implement them into the pages you make your XMLHTTP calls to… your security should be as strong as it always has been.

The AJAX security scares seem to only really be relevant to coders who have no common sense and haven’t dealt with authentication-at-all-stages before. (ie. Somebody who isn’t a secure web-app developer in the first place… which is something they should learn at the server-side code stage anyway!!!)

I know… that’s kinda rough.. but I’m sure I’m not far off the truth.

(at least.. having developed lots of web-apps… that’s what I’ve observed so far.)

When the document is requested from the server, the server creates a uniqueId and set it as a session variable and also writes it to the documents javascript. Now the session variable is explictitly bound to the window requesting the document.

On every Ajax request made to the server, the variable has to be sent as well. Before the serverside Ajax handler does anything, it checks whether the session variable is the same as the sent variable;
- If it is the same continue (request origins from a page issued by the server)
- Else ignore the request (request origins from untrusted source)

This is the serverside…about clientside code injection:
- The drag’n drop injection can be cancelled.
- Location bar injection is possible way to inject code (open a window without location bar?)
- GreaseMonkey is a huge problem; an attacker can build custom tools to attack the server. I don’t know how this can be stopped.

This is not a definite solution but augments the security a nudge. I am very intressted in other and/or additional suggestions. This is an important topic.

In addition, the business with cross-site request forgery is pretty off topic, especially considering XHR does not allow you to make cross-site requests.

Securing ajax apps is no different than securing any other dynamic webapp. The real risk is that with all of this exuberance and fine-grained access, people can fail to see the forest for the trees.

Yah AJAX is just a new way of doing old things and it cuts down on refreshing whole pages, but it does add new vectors of attack so I think it should be a consideration, especially for developers going straight into AJAX.