Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 0 down vote favorite

I have a social network that I am creating and have a security question. I have the ability to have friends on the website and when you request a friend it would be a button that would run a script with AJAX using jQuery.

I know that javascript can be easily hacked and also read here http://www.acunetix.com/websitesecurity/ajax.htm that AJAX is not as secure as it would seem. They state that "Since XML HTTP requests function by using the same protocol as all else on the web (HTTP), technically speaking, AJAX-based web applications are vulnerable to the same hacking methodologies as ‘normal’ applications" .

So basically I don't want a worm to just keep running friend requests through my AJAX function and someone signs on the site and they have 14 million friend requests. This is also an issue with several other AJAX scripts that I run on the site. The question that I have is that should I just keep everything server side. I am using php so should every friend request just be a reload of the page as much as I would like to avoid such a thing? Please any help would be greatly appreciated.

share|improve this question

1 Answer

up vote 1 down vote

Really there is nothing different about this then any other application that accepts user input and has client-server communications. The fact that it's initiated by JavaScript is irrelevant. You need to implement the usual safeguards for transmitting data (SSL) and also have some form of user authentication involved (login/password, tokens, etc).

Your server side script shouldn't care whether it's an Ajax request or regular form submission as it gets the same data either way. It should validate the request is authentic and validate the data accordingly.

Since I'm sure you built this site using the principle of Progressive Enhancement and it works without JavaScript being enabled you shouldn't have to do anything special for the Ajax requests. If you do then you've made errors with the basic functionality of your application and need to revisit it.

share|improve this answer
Well pretty much if you sign in a seession variable is created with your sign on ID So if you do it with AJAX it calls the script independantly so that session variable wont be able to be used . There will be no other sign on authentication because the user is signed on already and is using AJAX. PLease can you explain in technical terms how I would be able to authenticate that it is coming from a user rather than a bot or worm of some sort. – user6326 Mar 24 '11 at 20:19
@Dom, PHP session variables work with Ajax. The session ID is sent along with the headers as usual so your PHP script should have no issues identifying a user via Ajax. – John Conde♦ Mar 24 '11 at 20:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.