Comments on: Making your web applications more secure:

By: AbuKhaled

AbuKhaled — Mon, 19 Feb 2007 07:00:30 +0000

Good article. I understand SQL Injection and I m currently develop my own application to test it using C#.
I do not understand the remaining subjects.
Regards,
AboKhaled

By: Georges

Georges — Fri, 02 Feb 2007 15:53:40 +0000

Tanks for that enlightmeng Nadav ;)

I also read your article on your site. I certainly will implement this level of security in my next project.

By: Nadav Samet

Nadav Samet — Fri, 02 Feb 2007 14:56:23 +0000

Georges, one way to handle this is that the application will serve the request only if it gets a certain query argument. That value of this argument should be something that only your site can produce and validate, but it will be harder for another site to produce. For instance, it can be a SHA1 of the username and some secret word of your choice.

So you can easily validate this on every sensitive request, but remote sites can’t produce this value easily.

By: Georges

Georges — Fri, 02 Feb 2007 13:37:29 +0000

@Nadav: Ok, so I missunderstood that sort of attack! But how to stop/detect such attacks?

By: kourge

kourge — Fri, 02 Feb 2007 10:57:51 +0000

Ajax.Request if a component of Prototype, not Scriptaculous.

By: ajaxianfading

ajaxianfading — Fri, 02 Feb 2007 10:28:18 +0000

Exactly! And – going by the first comment to this post – that’s why we need reminders on good practice.

By: Nadav Samet

Nadav Samet — Fri, 02 Feb 2007 10:09:27 +0000

George, the client is not the criminal but the victim. He may browse the criminal’s website while he is logged in to the bank in another browser window.

By: Georges

Georges — Fri, 02 Feb 2007 08:42:36 +0000

So I do not understand how others are programming their projects using Ajax, but I think that there is a simple way to code secure Ajax apps. Well, just take Ajax-Request like common page requests (for instance browse from one page to antoher within the website). There are always some security methos involved when the request starts. Just like checking GET/POST Data, Session Variables and so on.

Now when using these methods within the Ajax-Request, there should not be any trouble with the security of the website compared to to the normal old fashined way!!!

In the example above, the scripts inside monthly_statements.js should just make sure that DATA is only sent to clients who have a valid and running session. If the client (in this case the criminal) would not be authenticated and so there should be no data for him!!!