AJAX Resource Center
ajax security
AJAX (Asynchronous Javascript and XML) Security

All things related to website security including web application security, database security, web server security, and web application server security. The Application Security FAQ

Using the XMLHttpRequest Object and AJAX to Spy On You

While the XMLHttpRequest object and AJAX can provide huge user and developer benefits, there are some issues you probably haven't thought about yet—but it's time everyone did.

AJAX Security - IT Observer

Web developers cannot have failed to notice the excitement surrounding AJAX or Asynchronous JavaScript And XML. The ability to create intelligent web sites such as Google Suggest or compelling web-based applications such as Gmail is thanks in no small part to this technology. There is, however, a darker side - and accompanying the growth in AJAX applications we have noticed an equally significant growth in security flaws, with the potential to turn AJAX-enabled sites into a time bomb.

AJAX Security Hole

AJAX Security Hole

Eric Pascarello dissects Ajax security vulnerabilities

News and advice for IT professionals working with Web services and application integration.

(Informal) Thoughts on AJAX and Security

I'll be the first to tell you: AJAX does NOT substantially change the typical web application security audit methodology. However, if you are a developer or a security professional, there are a few issues to consider and watch out for.

AJAX Security Threats and Performance Challenges - JAVA J2EE PORTAL

,Java & enterprise java portal with interviews, articles, blogs and reviews.

Robert Hurlbut's .NET Blog : Article on AJAX Security

I found this link to an interesting article on AJAX Security yesterday on the Secure Coding Mailing List, posted by Kenneth R. van Wyk. The article is by Stewart Twynham of Bawden Quinn Associates. The key points to take away are in the summary:

Jason Salas' WebLog : More concerns about Ajax programming as a security risk

I previously inquired about whether Ajax programming would pose an increased risk for web apps to become compromised or rendered inoperable due to DOS attacks.  I found a link from JamesDam.com about Ajax, and the author (James, assumedly) noted

Thousands struck by AJAX security hole - Xatrix Security

Xatrix Computer Security: A security hole in CPAINT, a popular development tool, has severe implications for a number of the Internet's most popular applications, including Gmail, Flikr and MSN Virtual Earth.

JavaScriptSearch News: Cenzic Extends Support for AJAX Security Assesment Applications

JavaScript Search is your source for hundreds of free JavaScripts and JavaScript related information, including scripts, tutorials, FAQ's, tips, and much more.

AJAX security issues?

Advisory says ajax poses security risk ajax security issues?

Cascading Style Sheets / Sample Code / AJAX Security Risks - WebReference Update

The WebReference Update for January 30, 2006. Features include: Cascading Style Sheets / Sample Code / AJAX Security Risks

AJAX Poses Security, Performance Risks

Forum Systems issues an alert, claiming Asynchronous JavaScript and XML leaves applications exposed to Web services vulnerabilities.

AJAX Experts Tackle Security, Other Issues

A panel of experts answer questions about security, tooling, support for devices and what Microsoft will do regarding AJAX.

Jay Kimble -- The Dev Theologian : Security and AJAX (an AJAX musing)

Michael Howard (one of the Author's of Writing Secure Code) says that there are 2 types of security problems: those involving untrusted input and everything else.  It's true.  Most of the security issues that we face and have to deal with in

Cenzic extends security umbrella to Ajax - Computer Business Review

While the emergence of Ajax has spawned visions of a smarter Web 2.0, until now few have focused on how to make Ajax sessions secure. Cenzic Inc, a five-year old firm that specializes in security testing tools automating web hacker attacks, this week added new features to cover Ajax.

XML.com: Fixing AJAX: XMLHttpRequest Considered Harmful

Jason Levitt shows us how to work around XmlHttpRequest restrictions in order to get more joy from third-party web services.

adaptive path » ajax: a new approach to web applications

A User Experience design and consulting firm that unites theory and practice to advance the art of user experience design while helping clients make better business decisions. Located in San Francisco, California, USA.

NewsForge | AJAX Security

AJAX Security -- article related to Software, Security, and NewsVac.

Ajax Training : Introduction to Ajax Development

Ajax (Asynchronous Java and XML) has emerged as a powerful platform for building web applications with extensive client-side interactivity. Unlike older approaches, which require reloading of the entire page with every postback, Ajax uses the JavaScript DOM, the XMLHttpRequest object, XML, and CSS to download and display just the content that needs to change. All Accelebrate courses are taught exclusively on-site at their clients' locations worldwide for groups of 3 or more attendees and are customized to their specific needs. All attendees should be fluent in HTML and CSS, and have extensive experience with JavaScript. Prior experience with XSL is not presumed. Training includes: The four defining principles of Ajax; Ajax rich clients in the real world; The key elements of Ajax; Loading data asynchronously using XML technologies; Third-party libraries and frameworks; Working with the server side; Security and performance with Ajax.

JavaScript: AJAX Security

Hi, If my web application is using SSL, will AJAX request also be encrypted, ie if i send information in plain text using AJAX, will it be encrypted? Kind Regards, Mike

Slashdot | An Ajax Reality Worth Worrying About

An Ajax Reality Worth Worrying About -- article related to Developers, Programming, and The Internet.

Slashdot | Open Source AJAX Webmail

Open Source AJAX Webmail -- article related to Developers and PHP.

Is AJAX a security risk? | | Feb 10, 2006 | Network Computing

Asynchronous JavaScript and XML has come under scrutiny recently, after it was discovered that AJAX has the potential to expose browsers to potential security problems.

Denim Group Unveils Security Scanner For AJAX @ AJAXWORLD MAGAZINE

Denim Group announced the public release of Sprajax, an open source web application security scanner developed to assess the security of AJAX-enabled web applications.Sprajax is the first web security scanner developed specifically to scan AJAX web applications for security vulnerabilities.

Denim Group - Knowledge

Consultancy offering secure software development, web portal design, and web application security including j2ee/java and .net security. Computer security training available.

Blogs Ajax - Blauer Bote Canada

Blauer Bote Canada Blogs Ajax

ZapThink :: News - Forum Systems Issues Alert for Ajax Related Security Threats and Performance Challenges

Focused research, analysis, and insight on XML, Web Services, and Service-Orientation

ZapThink :: News - Ajax alert raises security, scalability issues

Focused research, analysis, and insight on XML, Web Services, and Service-Orientation

Forum Systems Issues Alert for Ajax-Related Security Threats

Forum Systems Issues Alert for Ajax-Related Security Threats

Amazon.com: Ajax in Action: Books: Dave Crane,Eric Pascarello,Darren James

Amazon.com: Ajax in Action: Books: Dave Crane,Eric Pascarello,Darren James by Dave Crane,Eric Pascarello,Darren James

Rating Demystified: Ajax Way, Amazon Way* - The Code Project - ASP.NET

Ever wondered, how the amazon rating system works with multiple items in the same page, here is a simple article to describe the basic bare bones needed to create an aynchronous rating module using ASP.NET , SQL Server and ..... AJAX

Temporally Relevant

Just another geek on a mission.

Denim Group - Sprajax - Coming Soon

Consultancy offering secure software development, web portal design, and web application security including j2ee/java and .net security. Computer security training available.

Ajax and Your CMS -- CMS Watch

AJAX is cool, but is it functional? Jonathan Downes and Joe Walker look at the prospects for Ajax interfaces in Web content management systems, and f

Techworld.com - Google, MSN, Flickr... struck by security hole

Techworld Online Magazine. Your essential IT resource. Features all the latest IT news, reviews, new products, comprehensive product reviews, how-to articles and email newsletter

Rootsecure.net | News Item

Rootsecure.net features comprehensive hand picked links to the new security related news articles every day, along with a daily mailing list bringing the latest security news direct to your inbox every morning.

Denim Group creates new security software for AJAX applications - San Antonio Business Journal:

American City Business Journals Inc. is the nation's largest publisher of metropolitan business newspapers, serving 41 of the country's most vibrant markets.

Ajax Poses Security, Performance Risks | IT Business Edge

Ajax Poses Security, Performance Risks | IT Business Edge

New Ajax-Centric Features Added to Cenzic App Testing Tools | IT Business Edge

New Ajax-Centric Features Added to Cenzic App Testing Tools | IT Business Edge

ASTALAVISTA SECURITY GROUP | Information and Internet Security Portal

Information Security Portal

Developer Security : AJAX makes your apps more attractive....to hackers

No one denies the utility and popularity of the AJAX programming model and associated technologies, but few acknowledge the inherent security danger in an application model that more or less promotes more logic and decision making on the client.

NewsForge | AJAX Poses Security Risk

AJAX Poses Security Risk -- article related to Software, Security, and NewsVac.

What is Information Technology | Technical Search Engines | Technology Portal

What is Information Technology up to now? Use our technology portal to find out. This is one of the best technical search engines to look for the latest IT articles and resources.

JavaScriptSearch News: Denim Group Releases an Open Source Security Scanner for AJAX

JavaScript Search is your source for hundreds of free JavaScripts and JavaScript related information, including scripts, tutorials, FAQ's, tips, and much more.

JavaScript and AJAX:

. Browser Side World JavaScript and AJAX

AJAX Login System using XMLHttpRequest | evolt.org

A world community for web developers, evolt.org promotes the mutual free exchange of ideas, skills and experiences.

Songhay System

Songhay System Company Web Site with online tutorials and in-depth technical articles.

Considering Ajax, Part 1: Cut through the hype

Lately, interest in Ajax (Asynchronous JavaScript and XML) is high. Various Ajax applications provide a more interactive and rich client experience than traditional Web pages. Using Ajax, you can deploy new and innovative aggregation and presentation techniques in an unprecedented fashion. Inspired by Alex Bosworth's list of Ajax mistakes, Chris Laffra has compiled a set of discussion points for every developer to consider before using Ajax techniques for a Web site that he outlines in this two-part series. Some points are potential problem areas; most highlight Ajax's great potential.