5

Lets consider next scenario: assume I have a web app, and authentication of users is performed through a modal dialog window (lets say, that when a user clicks login button, ajax request is sent and depending on the callback I either close the window or display an error), and I use only HTTP protocol. Why is it considered to be not secure way to do things?

Also, please make sure that a modal dialog window is taken into account, because this is vital info. There may be some data displayed underneath the dialog window and can be accessible if modality is broken.

The question includes both:

  1. How can you break an app security by utilizing ajax call?
  2. Is Ajax HTTP less secure than a regular form HTTP?
7
  • 1
    Who considered this to be not secure? or Who considered this to be less secure than regular forms?
    – zerkms
    Nov 15, 2010 at 9:55
  • This is actually a question of why, not who. If comparing with HTTPS there's no doubt it is insecure. What I want to know, is why.
    – Denys S.
    Nov 15, 2010 at 10:02
  • Can you clarify the question? Are you asking is Ajax HTTP less secure than Ajax HTTPS? or Are you asking is Ajax HTTP less secure than a regular form HTTP?
    – UpTheCreek
    Nov 15, 2010 at 10:03
  • Unless you encrypt it using SHA or MD5 before sending it to client, the password is transmitted in plain text. AJAX or not. Nov 15, 2010 at 10:03
  • 1
    @Rosdi: if you've caught md5'ed password - you can always repeat the same request with same md5 string and get authenticaion :-) (unless you're using some kind of additional tokens)
    – zerkms
    Nov 15, 2010 at 10:05

6 Answers 6

10

Whoever told you - he is wrong. The ajax through post is not less secure than post with regular forms. Just because it is the same thing.

Update 1 according to the last edit:

  1. You cannot
  2. No

Argument: the AJAX request is the same http request as any other (such as request sent by html form). Absolutely the same. So by definition it cannot be less or more secure.

I don't know how to explain more and what to say else: ajax is a http request. the same request as your browser does when you open SO page or when you post the SO question form.

I can rephrase your question to something like "Why A is less secure than A". Answer to it: A is not less secure than A, because A is A :-S

4
  • Can you please post some arguments in addition to your answers?
    – Denys S.
    Nov 15, 2010 at 10:21
  • @zerkms: You did, thank you for that as I can see your point clearly. But the idea that I don't get is next: while in simple form authentication when pressing login button request is sent and that's it, if using the dialog window, there's a chain of js calls (I'm not a js expert though), which, if let's say some sort of js is attached to the bottom of the page, can be simply changed and result in anything js will allow you to do. If I can accomplish that, I can easily send two requests - 1 to get logged in, and other one to get credentials to someone. What than(if it's possible)?
    – Denys S.
    Nov 15, 2010 at 10:57
  • @den-javamaniac: perhaps you could tell us how you were led to believe that ajax is less secure?
    – UpTheCreek
    Nov 15, 2010 at 10:59
  • 2
    @den-javamaniac: re your last comment. There is no reason why you could not add some js to a page to do exactly the same thing with a regular form.
    – UpTheCreek
    Nov 15, 2010 at 11:01
2

Any sensitive data should be channeled through HTTPS. GET data is sent in the querystring. POST data is sent in the HTTP Request header. Ajax can do both. BOTH are not secure. You need a channel level encryption to really secure it.

1

HTTP isn't secure for private data because the data is transmitted in plaintext. This can be intercepted anywhere between the client and server (eg. wifi.) Ajax over HTTPS would be much better.

1
  • But isn't be asking why ajax would make it less secure?
    – UpTheCreek
    Nov 15, 2010 at 10:01
1

I think the issue is that you are using http. No matter how you look at it it wont be secure. If you use https the ajax request will be just as secure as a html form.

Somy answer would be to use https and you will be all set.

0

I'm no security expert, but I think it might be more secure sending it over HTTPS. Just googling learns me that it can be done securely though:

http://www.indicthreads.com/1524/secure-ajax-based-user-authentication/ http://msdn.microsoft.com/en-us/magazine/cc793961.aspx (focused on ASP.NET) etc.

0

Since browsers use the same network stack for HTTP and HTTPS, be it AJAX or not, there is no difference. All the headers, cookies, authentication, etc work exactly the same.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.