Question

Frequently when I work on AJAX applications, I’ll pass around parameters via POST. Certain parts of the application might send the same number of parameters or the same set of data, but depending on a custom parameter I pass, it may do something completely different (such as delete instead of insert or update). When sending data, I’ll usually do something like this:

$.post("somepage.php", {action: "complete", somedata: data, moredata: anotherdata}, function(data, status) {
    if(status == "success") {
        //do something
    }
});

On another part of the application, I might have similar code but instead setting the action property to deny or something application specific that will instead trigger code to delete or move data on the server side.

I’ve heard about tools that let you modify POST requests and the data associated with them, but I’ve only used one such tool called Tamper Data for Firefox. I know the chances of someone modifying the data of a POST request is slim and even slimmer for them to change a key property to make the application do something different on the backend (such as changing action: "complete" to action: "deny"), but I’m sure it happens in day to day attacks on web applications. Can anyone suggest some good ways to avoid this kind of tampering? I’ve thought of a few ways that consist of checking if the action is wrong for the event being triggered and validating that along with everything else, but I can see that being an extra 100 lines of code for each part of the application that needs to have these kinds of requests protected.

Answer 1

You need to authorize clients making the AJAX call just like you would with normal requests. As long as the user has the rights to do what he is trying to do, there should be no problem.
You should also pass along an authentication token that you store in the users session, to protect against CSRF.