Desmond File

Blog archive

AJAX: Savior or Security Scourge?

"Computers have enabled people to make more mistakes faster than almost any invention in history, with the possible exception of tequila and hand guns." --Mitch Ratcliffe

After a recent announcement by threat identification and remediation tools vendor Fortify Software, maybe we should add AJAX to that list. The company says a security vulnerability could make AJAX-based applications susceptible to "JavaScipt hijacking," which lets unauthorized parties read private content within JavaScript messages. You can read all about it in Jeffrey Schwartz's article here.

Of course, JavaScript exploits are nothing new. In January, Adobe kicked off a bit of JavaScript madness with its thoughtless implementation of JavaScript in the ubiquitous Acrobat browser plug-in. The setup pretty much opened the floodgates to phishers -- all they needed to do was get someone to click on a valid PDF file link.

But Brian Chess, co-founder and chief scientist at Fortify, says this is not your father's browser-based security problem. "It's not a new name for an old kind of problem. This is a new JavaScript-related problem that arises in AJAX-style applications," Chess said.

At issue are the AJAX frameworks and client-side libraries used for AJAX development, which Fortify found are often not designed to prevent JavaScript hijacking. The Microsoft ASP.NET AJAX tool (code-named Atlas), Google Web Toolkit and libraries such as Prototype, DoJo and Yahoo! UI are all affected, says Fortify.

The good news? Patching the hole should be quick work for tool providers, and developers can certainly prevent private information from being transmitted without authentication. Of course, all this argues back to the biggest issue with JavaScript and, going forward, AJAX. That is: In an era of intensely connected applications, you cannot afford to write crappy code.

What do you think? If we set down the hand guns and tequila bottles and focus on writing good code, can we ever hope to avoid calamitous mistakes? How is your company making sure its AJAX code isn't vulnerable? E-mail me at [email protected].

Posted by Michael Desmond on 04/04/2007 at 1:15 PM

comments powered by Disqus


  • .NET Core Ranks High Among Frameworks in New Dev Survey

    .NET Core placed high in a web-dominated ranking of development frameworks published by CodinGame, which provides a tech hiring platform.

  • Here's a One-Stop Shop for .NET 5 Improvements

    Culled from reams of Microsoft documentation, here's a high-level summary of what's new for performance, networking, diagnostics and more, along with links to the nitty-gritty details for those wanting to dig in more.

  • Azure SQL Database Ranked Among Top 3 Databases of 2020

    Microsoft touted the inclusion of Azure SQL Database among the top three databases of 2020 in a popularity ranking by DB-Engines, which collects and manages information about database management systems, updating its lists monthly.

  • Time Tracker Says VS Code Is No. 1 Editor for Devs, Some Working 15+ Hours Per Day

    WakaTime, which does time tracking for programmers, released data for 2020 showing that Visual Studio Code is by far the top editor/IDE used by its coders, some of whom are hacking away for more than 15 hours per day.

Upcoming Events