Question

I’m creating a web application that will use a lot of ajax calls. The application will hold user’s personal data. In the ajax calls are variables used like Id, profile_id, message_id etc.. to complete operations like adding posts to profiles, getting connections, etc..

I want to make the calls so secure as posible. I already implemented crsf in the $.post calls. What kind of varibales of the ajax calls must/should I encrypt and which not?

Example of a ajax call (simplified):

function post_msg(profile_id, msg) {
        var json_data = new Object(); 

        json_data.profile_id = profile_id;
        json_data.msg = msg;

        var data_str = JSON.stringify(json_data);

        $.post("/ajax/get_posts", { data: data_str, csrf_key: "950egg22b771xxxxxxxxxxxxxxxx1a"}, func_that_does_something_with_ret_data);
}

//Some where else in the front-end
$('#button').click(function() {
    var msg = $('#input').value();

    post_msg(1, msg); //should I encrypt the id?
});

Answer 1

Don’t think about encrypting individual bits of data. If security is important, run the entire transaction across HTTPS.