Web and Database Security
Jiping Xiong, Lifeng Xuan, Jian Zhao, Tao Huang · InTech eBooks · 2012
security threats.In recent years, adding AJAX elements in sites has become a very popular trend, and most websites are typical AJAX-based applications.As most of the website builders just enjoy the conveniences of AJAX technology, little is known about its security threat, resulting in most of the AJAX application sites have different levels of security risks.Here, we summarize and analysis the AJAX security threats.1. Security Threats of AJAX Technology a.The Deficit of JavaScript Language JavaScript is a widely client-side scripting language, originally designed and implemented by Netscape, and it has been widely used to reduce the burden on the server.JavaScript scripting language features determine its presence in all kinds of security risks:JavaScript is an interpreted language.In the interpretation process, every error is a runtime error.Run-time error can only be found during runtime.If somewhere in the code the programmer has left a Bug, but the logic of the code at run time is not running to the area, then the bug will not be found, which leaving significant risks to the application.To detect, locate the error position of interpreted language is quite difficult. JavaScript is a weak typing language.Weak typing languages do not need to declare variables at the time the programmer declare the variable.This flexibility often easily leads to many problems. JavaScript code has dynamic nature.It can be dynamically generated code, and used the eval-function dynamic execution; or you can directly modify the existing function.Once the attacker can gain control of the JavaScript code, he can overwrite the other user-defined methods and even the browser built-in method, thus cause many serious malicious behaviours.b.Problems of Asynchronous Asynchronous communication is the highlights and core idea of AJAX technology.But asynchronous will also introduce a series competition problems.