Desmond File

Blog archive

AJAX: Savior or Security Scourge?

"Computers have enabled people to make more mistakes faster than almost any invention in history, with the possible exception of tequila and hand guns." --Mitch Ratcliffe

After a recent announcement by threat identification and remediation tools vendor Fortify Software, maybe we should add AJAX to that list. The company says a security vulnerability could make AJAX-based applications susceptible to "JavaScipt hijacking," which lets unauthorized parties read private content within JavaScript messages. You can read all about it in Jeffrey Schwartz's article here.

Of course, JavaScript exploits are nothing new. In January, Adobe kicked off a bit of JavaScript madness with its thoughtless implementation of JavaScript in the ubiquitous Acrobat browser plug-in. The setup pretty much opened the floodgates to phishers -- all they needed to do was get someone to click on a valid PDF file link.

But Brian Chess, co-founder and chief scientist at Fortify, says this is not your father's browser-based security problem. "It's not a new name for an old kind of problem. This is a new JavaScript-related problem that arises in AJAX-style applications," Chess said.

At issue are the AJAX frameworks and client-side libraries used for AJAX development, which Fortify found are often not designed to prevent JavaScript hijacking. The Microsoft ASP.NET AJAX tool (code-named Atlas), Google Web Toolkit and libraries such as Prototype, DoJo and Yahoo! UI are all affected, says Fortify.

The good news? Patching the hole should be quick work for tool providers, and developers can certainly prevent private information from being transmitted without authentication. Of course, all this argues back to the biggest issue with JavaScript and, going forward, AJAX. That is: In an era of intensely connected applications, you cannot afford to write crappy code.

What do you think? If we set down the hand guns and tequila bottles and focus on writing good code, can we ever hope to avoid calamitous mistakes? How is your company making sure its AJAX code isn't vulnerable? E-mail me at [email protected].

Posted by Michael Desmond on 04/04/2007 at 1:15 PM

comments powered by Disqus


  • VS Code Java Team Details 5 Best Dev Practices

    Microsoft's Visual Studio Code team for Java development added a new Coding Pack for Java installer and detailed best practices for setting up a development environment.

  • Binary Classification Using PyTorch: Defining a Network

    Dr. James McCaffrey of Microsoft Research tackles how to define a network in the second of a series of four articles that present a complete end-to-end production-quality example of binary classification using a PyTorch neural network, including a full Python code sample and data files.

  • Blazor Debugging Boosted in .NET 5 RC 2

    In highlighting updates to ASP.NET Core in the just-launched second and final Release Candidate of .NET 5, Microsoft pointed out better debugging for Blazor, the red-hot project that allows for C# coding of web projects.

  • Block Stack

    Final Go-Live .NET 5 Release Candidate Ships Ahead of Nov. 10 Debut

    Having been deemed "feature complete" and "near final" and "go live" for some time now, .NET 5 is out in a second and final Release Candidate, scheduled for a Nov. 10 debut during .NET Conf 2020.

  • Edge Browser Dev Tools for VS Code Now Generally Available

    Microsoft has moved its Edge browser development tools for Visual Studio Code from preview to general availability, providing in-editor web site debugging and other functionality.

Upcoming Events