Ajax Security

Ajax or ‘Asynchronous JavaScript and XML’ is a generally new and dynamic technology on the web, which runs in asynchronous way to interact with the server.  In a classical web approach for making another need the browser needed to refresh whole page and reload it, which was both timeless and data transfer capacity expending.  Here we explain about some security issues.

With AJAX, the subroutines can ask for the server for new bit of data without completely reloading the page, hence giving clients a faster and enhancing knowledge. It happen background without user’s information and what the client sees is a smooth experience.

The XMLhttpRequest item is used to do the cooperation with the server. One basic sample of the Ajax request is the population of suggestive words, while we begin writing the words. Without sending the whole substance, it continues speculating, overhauling and stacking the query items without hitting Search catch.

The information in an Ajax request/reaction can be as XML or JSON, which is viewed as a light weight data to transport contrasted with the customary structure based data.

Ajax Security

Ajax Security: Server Side

  • AJAX-based on Web applications use the same server side security plan of daily Web applications
  • You determine approval, confirmation, and data security prerequisites in your web.xml record (revelatory) or in your project (programatic)
  • AJAX-based Web applications are liable to the same security Risk as daily Web applications

Ajax Security Concern

Ajax Security: Client Side

  • The JavaScript code is mention to a user/hacker. Hacker can using the JavaScript code to involve server side weaknesses
  • The JavaScript code is downloaded from the server and executed at the user and can be relaxed the user by mal-proposed code
  • Downloaded JavaScript code is include by sand-box security show and can be loose for marked JavaScript

JSON Hijacking or leakage of Data in Ajax:

Before proceeding onward lets comprehend an essential component:

  • JavaScript outflow
  • JavaScript Array

The parser used for JavaScript don’t execute JavaScript expression,however arrays are:

For example


{"t":1,"p":1,"r":1,"rows":[{"i":0,"d":["m","M, E","b","7","t","m"]}]}


This statement will not be executed, because, objects will not be created. The above code is for a JavaScript statement.

The Scenario

  • First of all user logs into a vulnerable application (J2EEbrain.com) which server is JSON in type of Array and data are casa sensitive in nature. The user gets the approval token (AUTH) by the application.
  • And the second thing is the attacker gets in the logged in user to click on a link, and using Phishing.
  • The user clicks on the link, which stacks the page from the assailant’s site, which implants the accompanying script
Object.prototype.__defineSetter__("t",function(obj){alert(1);for(var i in obj) {alert(i + "=" + obj[i]);} });
src="http:// J2EEbrain.com/mainjson"/>/this focuses to the JSON

The script again makes a request to J2EEbrain.com and accesses the basic JSON page which sends the case sensitive data once more to the attacker’s page, the JSON data and the AUTH token.

While, the requirements for the above result are that the JSON data must be case sensitive in nature and the program should receive defineSetter technique, which overrides the existing DOM or functions when a property setter is called. In above code, at whatever point a property “t” is, being called, a function sign and it is displays. However very few programs support “defineSetter” technique now.

How to overcome:

  • Don’t send case sensitive data in JSON or do not send them using JSON array, which makes it a valid JavaScript that can be find through script tag.
  • Serve the validated request only – means use an approval to secure the data
  • JSON data must be not be sent over GET, but only via POST, which is make it hard to involve the URL in <script> tag

Role of CSRF

The CSRF exploits an essential imperfection in web technology, which is upon cookie, based approval and submits it with each request from user to the server. CSRF stands for Cross Site Request Forgery.

Difference between CSRF and Ajax

Although the CSRF is basically common in traditionally web applications, if prevention is not built, it likewise can be completed on Ajax based web applications. Ajax itself is for the most part a non specific term for different JavaScript systems used to join with a web server dynamically without fundamentally stacking various pages. The main trouble is, since it’s a hidden request, it’s not that straight forward to make a valid request. We have to art the consistent request as well as we have to stick to the valid data design.