Question

Lets consider next scenario: assume I have a web app, and authentication of users is performed through a modal dialog window (lets say, that when a user clicks login button, ajax request is sent and depending on the callback I either close the window or display an error), and I use only HTTP protocol. Why is it considered to be not secure way to do things?

Also, please make sure that a modal dialog window is taken into account, because this is vital info. There may be some data displayed underneath the dialog window and can be accessible if modality is broken.

The question includes both:

1. How can you break an app security by
   utilizing ajax call?
2. Is Ajax HTTP less secure than a
   regular form HTTP?

Answer 1

Whoever told you – he is wrong. The ajax through post is not less secure than post with regular forms. Just because it is the same thing.

Update 1 according to the last edit:

1. You cannot
2. No

Argument: the AJAX request is the same http request as any other (such as request sent by html form). Absolutely the same. So by definition it cannot be less or more secure.

I don’t know how to explain more and what to say else: ajax is a http request. the same request as your browser does when you open SO page or when you post the SO question form.

I can rephrase your question to something like “Why A is less secure than A”. Answer to it: A is not less secure than A, because A is A :-S