Question

I have a codeigniter application in which i do most of the stuff by way of ajax calls. For instance lets take the account creation. There is a form with four fields, username, password, email and mobile.

frm = $("signupform").serializearray();
$.post(base_url + "/auth/ajaxlogin/", frm, function(data){
                if(data==="true") {
                    window.location.reload();
                } else {
                   $("#loginresult").show(); 
                }
            });

with this script i am taking care of sending the account details to the account creation method in the auth controller, creating the account and signing the user in. But im sure that this is highly vulnerable, say any user can write a malicious script to continuosly create accounts in their js console. So what is the best way to secure certain functionality like this.

Answer 1

The Ajax is irrelevant, as far as the server is concerned, an HTTP request is an HTTP request.

Use the normal approaches for defending against that kind of attack:

• Confirmed opt-in test sent to the email address
• Rate limiting
• Captcha (only if the above don’t provide sufficient protection, they annoy people)