Have Geek Brain

Mixing jQuery Ajax with ASP.NET: is there any security risk

I am using jQuery with ASP.NET in a project. Instead of using ASP.NET Ajax, I am using jQuery ajax. Is there a security risk if I do this? What I mean is that since I'm using jquery ajax calls, the view state information will not be passed to the server so it can authenticate the page (although it saves a lot of bandwidth ..).

I would also like to know what is the best / good practice here.

+2


a source to share


3 answers


Microsoft has included JQuery in their versions of Visual Studio (see http://weblogs.asp.net/scottgu/archive/2008/09/28/jquery-and-microsoft.aspx )

If there was a big security risk they probably wouldn't;)



As with other web applications, you never trust the data you receive. It doesn't matter if you are working with ASP.Net AJAX, JQuery or any other library. Web requests can always be spoofed. This way you always sanitize the input you receive and make sure the user is authenticated (ASP.Net forms authentication uses cookies, not viewstate).

+4


a source


Make sure you validate all user input. And send basic authentication information to your web services (jQuery.ajax has a data parameter) so no one can use the services without being logged in.



Passing the session GUID and thus providing full web service authentication is sufficient protection for most applications (in addition to the usual security checks such as input validation). You can specify what level of security your application requires.

+2


a source


I use the same practice on many cases - jQuery ajax on aspx pages

You can check 3 thoughts (pick 1-2 of them) and make sure none of them can create problems on your site.

  • Send all encrypted messages (if possible).
  • Send a hash value with the message data - and check the hash correction (if you can).
  • Make sure calls are coming from your host at the url.

for example you have a page http://www.yourhost.com/askforajax.aspx 'make sure the url starting with http://www.yourhost.com/ '

The hash I mean here should be your hash check implication or crc or whatever you like, you can call it.

here is a real ajax call from my pages

doSomeWork.aspx PLIST = 36 &? Pslst = 1 & e = 1202638085 & e = 12585795

The last 2 parameters are control parameters.

Also inside the ajax page, which results in the calculations checking each parameter for correctness.

I also check some other thoughts in some cases, for example if a user clicks on a button that makes a change, that user must have cookies enabled, so I check if the hash of the users' cookie is the same.

To check url

I believe Request.ServerVariables ["HTTP_REFERER"] can do the job of checking where the request comes from.

HTTP_REFERER Returns a string containing the URL of the page that linked to the current page using a tag. If the page is redirected, HTTP_REFERER is empty

Hope it helps you.

+2


a source






More articles:


All Articles