Home/ Questions/Q 8113143
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T02:44:01+00:00

[I hope that this question is not too broad, I think that the subject

  • 0

[I hope that this question is not too broad, I think that the subject is very interesting but I incourage you to tell me if it’s off-policy.]

My scenario is this:

  • I have a LAMP website who stores also sensitive data and documents
  • Only registered users are allowed to operate on the site, and only on certain data and documents. Users are stored in $_SESSION variables
  • Most of the pages implement a sort of rudimental permission control, but some important DB operations are called via AJAX
  • AJAX security is implemented very poorly, as anyone that is that smart can tamper with the request sending whatever id they like and delete records with brutal simplicity

Asking for a complete book on security is obviously a bit too much (and I’m already reading and trying a lot on the subject), let’s say that my main concern is if AJAX pages should be treated with special regards, as I need to secure the whole software to prevent hacks and other problems.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I have a LAMP website who stores also sensitive data and documents

    You should store as little sensitive data as possible. Especially when you are not sure how to keep this information secure/private. Use OpenID or something for your authentication for example. I really like LightOpenID for it’s simplicity. I created a little example project/library to see lightopenId in use. It simplifies using OpenID by using openID-selector. When you use OpenID you also use secure OpenID providers the passwords are also not transmitted over the wire in plain-text but protected by https/SSL.

    Only registered users are allowed to operate on the site, and only on
    certain data and documents. Users are stored in $_SESSION variables

    Yup that’s what sessions are for.

    Most of the pages implement a sort of rudimental permission control,
    but some important DB operations are called via AJAX

    You should read up on OWASP top 10. at least. (Don’t stop at 10.)

    AJAX security is implemented very poorly, as anyone that is that smart
    can tamper with the request sending whatever id they like and delete
    records with brutal simplicity

    See previous section. Read up on OWASP top 10 section at least. Somethings which a lot of people overlook for example are CSRF for example.

    • 0