AJAX Best Practice Web Service
I am using a dispatcher script to call a web method on the client side, but since you know that web methods do not work from within a custom control, so you need to create a web service to do this.
this will be fine but i have the following problems.
- If you are using a web method on an ASPX page the code is invisible to the user as I can prevent users from viewing my service and see my code and only allow the web service or user control.
- Is there anyway high approach users can use my code like Cross Site Scripting, Pinging, Etc ... with this approach.
- What exactly does the client see with this approach, the java script block of code I used to call the service or whatever?
- any additional advice would be fully appreciated.
a source to share
Without going into the .NET points, since this is not my field:
Anything that runs on the client (like JavaScript) is visible to users who can modify it as much as they like within their system.
Anything running on the server is not visible to users.
For the user to click the button and run the code on the server, the browser must send an HTTP request to the server. A simple approach is to use a form. This provides a standard way to structure your data .
More sophisticated approaches involve using JavaScript to explicitly create the request (not just for the browser to take care of it). This allows data to be passed in other ways than Visiting a New Page, which gives the flexibility needed for Ajax.
With either approach, you are essentially defining a public API that is accessible over HTTP.
There are two broad classes of attack that you need to defend (it doesn't matter if Ajax is involved or not, its still the same type of API).
- Direct attacks - validate the health of your data, prevent users from editing things without being authenticated.
- Indirect attacks - in which a third party tricks a user into entering bad data (for example, through a link on another site that asks their browser to make an HTTP request to your site). Protection includes things like requiring a client to request a one-time token before they can submit data (for example, by creating hidden input when a form is submitted before third parties can use their own form with malicious data and submit users to your site using JS).
In a nutshell: Use the same protections that you would use if JS weren't involved.
a source to share