The ABCs of AJAX security

Security is something we keep tucked away in the back of our minds and dust off occasionally. A conventional way of thinking about security has taken hold for web applications, but the arrival of AJAX means we need to rethink it a little.

AJAX exposes more of the following areas, which the server keeps more hidden in a conventional web application.

Exposure of Internal Details
 If there’s one thing that sets AJAX applications apart from conventional web applications, it’s mobile code. This is code that travels from the server to the client and is used there to interact with the server. As a result, certain sensitive information is exposed to the client, including method names, invocation context, and return types.
 Cross-Site Scripting
 Moving a large amount of code to the client creates ways to tamper with the application’s client-side state. Conversely, knowing that state can allow compromised code to call the server with a particular context.
 Denial of Service
 Exposing APIs for individual AJAX calls directly lets an attacker target small parts of a service and take the whole thing down. With services from different providers increasingly integrated into larger applications, distinguishing attacks from normal use is difficult.

Among the many interesting presentations at JavaOne 2007, one that particularly caught my attention was about security for AJAX or Web 2.0 applications. Wondering what it was called? You Are Hacked: AJAX security Essentials for Enterprise Java Technology Developers. I highly recommend studying it.