Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am considering using AHAH extensively on a project and am concerned about security. Couldn’t an attacker inject malicious code into my response that would then be executed in the client? If my AJAX response is JSON, I don’t have to worry about this because if things are tampered with the JSON will no longer be valid.
On the other hand. It doesn’t seem that AHAH is any greater risk than any normal non-https request. Is there something that I am missing or what are some other thoughts?
Couldn’t they do that to a normal page that does not have Ajax? Ajax is a normal HTTP request. There is nothing new here, same security rules apply.
If they can tamper with HTML in AHAH, they can tamper with the JSON/XML/Text in those requests so it is valid.