-3

I'm currently developing a penny auction website to test my ability at programming javascript and using AJAX effectively. However, I have come across the problem of security.

Firstly, I have been debating whether authentication should be handled server side or client side but have come to a decision that the PHP could handle this much more easily. For instance, when a user sends a bid via ajax to a php file on the server this will then check if the user is logged in and then then sanitise the data before the bid is entered into the database.

Secondly, Is there any way of encrypting or obscuring data being sent as due to javascript's open nature it seems to pose a considerable threat?

Thanks.

1
  • 2
    Didn't feel there was a need for down votes... Sep 12, 2011 at 0:04

2 Answers 2

2

Clients to web applications are inherently untrusted, since you have no control over what the user's browser is going to do. Therefore, never rely on the client to perform sensitive operations.

To answer your specific questions, definitely perform all the authentication and authorization checks on the server side. SSL/TLS encryption will protect data in transit between the client and server, but the data will unavoidably be unencrypted once it reaches the client, so you can't use encryption to somehow hide or protect data from the client and still expect the client to be able to do anything with it.

1
  • Thanks, I was afraid that this may happen. It's not such a big deal anyway, I can deal with any serious issues server side. SSL is definitely an option though Sep 12, 2011 at 0:05
1

Security through obscurity is no security at all, as always. If the information you're keeping in JavaScript is so sensitive that it can't be seen and is a risk because of "JavaScript's open nature", it should not be in JavaScript.

3
  • No need to be so sarcastic, I overestimated JavaScript's usefulness. Sep 12, 2011 at 0:07
  • 2
    @Daniel West: There was no sarcasm in that post whatsoever. Security through obscurity is never security.
    – Ry-
    Sep 12, 2011 at 15:30
  • Fair point, I was looking at the problem from the wrong angle Sep 30, 2011 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.