16

Am about to include a log in system to my web Site but i don't think it's a good idea for security to use ajax to send a and receive confirmation from an external php script called login.php and log-out the same way with another logout.php any recommendation

1
  • How will it differ? at the end of the day it's just an HTTP request passed over the protocol, concentrate more on encapsulating that details with more server side verifications!
    – Arpit
    Aug 4, 2011 at 9:36

6 Answers 6

21

Security

AJAX is a as safe as a plain old form + refresh page. In the end it's always an HTTP request. Why do you think that ?

However, from a usability point, make sure that people that disable javascript can still log into your app.

Be sure to use POST method to send your AJAX request, as GET requests, and their params (such as, let's say, plain-text password) might end in your web server logs, unles you are using HTTPS.

Usability

As Grégoire pointed it out:

Also from a usability point, autocomplete won't work for AJAX forms on chrome, and for AJAX-loaded forms in firefox. The browsers won't even propose to remember your password

3
  • 2
    Also from a usability point, autocomplete won't work for AJAX forms on chrome, and for AJAX-loaded forms in firefox. The browsers won't even propose to remember your password.
    – greg0ire
    Mar 15, 2013 at 17:28
  • @greg0ire right, I'm experiencing these days, and it's not really funny :(. Editing to add your remark. Mar 18, 2013 at 8:53
  • 6
    I think that nowadays the sentence make sure that people that disable javascript can still log into your app should be amended. I cannot imagine any serious web application that works without javascript.
    – mat_boy
    Jul 4, 2016 at 11:10
13

I can't think of any security implications on using Ajax to handle login and logout. It doesn't matter what you send back and forth (as long as you don't send plain text passwords from server to client) between the ajax and sever side layer, because the session will be the one which will hold the authorization state.

However, you would still have to refresh the page, or redirect to show the appropriate content to the just authorized user. So, I don't think Ajax is going to be effective at this particular situation.

6
  • 5
    In fact, you send, from the client to the server, passwords in plain text (excepted for https pages). However, you shall be punished if you send plain text password from server to client. Aug 4, 2011 at 9:41
  • no i can just load the content that should be loaded with an ajax request i can simply load the container witch will change the content(at the server side )and send a different content (the appropriate content)
    – Qchmqs
    Aug 4, 2011 at 9:54
  • @Qchmqs: Then there is no security flow, because the authentication validation will be done on the server side. At the time you send back the response with the content you will check if the user has been authenticated.
    – Shef
    Aug 4, 2011 at 9:56
  • I don't think i had understand what u said ?
    – Qchmqs
    Aug 4, 2011 at 10:00
  • 1
    so i think i should go on with this idea and start coding right now ? (after a cigarette of course)
    – Qchmqs
    Aug 4, 2011 at 10:05
2

Login through ajax POST should be safe as long as you have a way of preventing the XSRF attacks. It can be done by setting X-CSRFToken header in your ajax request. On the server side you should have some sort of middleware to check and verify your CSRF Token from header.

You can set the csrf token in the cookie and then query it and set it in the header:

var csrftoken = $.cookie('csrftoken');

xhr.setRequestHeader("X-CSRFToken", csrftoken);

(I have used jquery cookie library here to illusrtate )

1
1

GET or POST versus ajax call do have the same set of security risks. The one or the other is not implicitly riskier.

4
  • 3
    GET request might end up in the web server logs, along with plain-text passwords :/ Aug 4, 2011 at 9:43
  • @clement: Sure, but that is true no matter the request is done via form or ajax.
    – Johan
    Aug 4, 2011 at 10:17
  • 2
    Right, so then it is even more false that GET or POST have the same set of security risks. Aug 4, 2011 at 12:16
  • 3
    @Johan I think the problem is your wording could be interpreted in multiple ways. What you meant was that normal GET or POST have the same security implications as AJAX GET or AJAX POST. But what you wrote could be interpreted as GET or POST have the same security risks whether it is AJAX or not.
    – Davy8
    Oct 10, 2011 at 20:17
0

You can use AJAX with an SSL container (HTTPS). But the sender page also mus be encrypted. because of the cross domain policy.

0

Well ajax posts are safe

It all depends on your coding you have to code keeping in mind all the possible attacks that can happen

use ajax just for sending data and do all the authentication in php and return a successful message

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.