[RESOLVED] Security JavaScript Vs Non-JS

[dougal85]

Is it any less secure posting variables with JavaScript as opposed to Posting via a form?

I realise the user could modify the JavaScript and thus effect what is being posted. However this applied to a page without any javascript too.

I'm doing my first security conscious Ajax website. Since the others have only used Ajax in open/public areas.

It's also really easy to see whats being posted in JavaScript with something like firebug - is it just as easy to do this with some other tool with forms?

[NogDog]

I would say that the security is essentially the same: i.e. they are both insecure since they are both easily visible to anyone who can access the web page. All data coming from the client must be filtered/validated on the server side, regardless of how it is generated on the client side, since it all ends up getting sent via HTTP requests which can be easily spoofed by any half-ways competent hacker.

[bpat1434]

Firebug can see anything sent from the browser to the server in a request. Just click on the "Net" tab and you'll get all calls for images, CSS, Javascript, or even HTTP requests. So as far as Firebug being an issue, it's moot. You can see just as much either with JS or regular HTML forms.

When creating an AJAX site you'd need to make sure all your data is sanitized (as Charles said) and also make sure you take into account XSS attacks as well as your AJAX library's (if you use one) security flaws.

[dougal85]

Cool thanks, thats pretty much what I had guessed just wanted to get a second opinion.