January 2008 — News
Print this article | Email this articleClick here to receive your FREE subscription to T.H.E. Journal
GWT: Advanced AJAX Security
The key is understanding JS variables. Essentially, everything is an object, including primitives and functions, Hoffman said. All global variables and functions are properties of a global object, and the Web browser provides a window into these objects. Hoffman's HOOK JavaScript Monitoring Framework (which a smart hacker could replicate) lets him enumerate the environment and trap on-demand code. It also sidesteps obfuscation by reading from the environment itself.
He also attacked what he calls the myth of the same origin policy, which claims that "same origin restricts" prevent JavaScript from seeing third-party content. In fact, it only does so partially, he said.
Stop JSON Hijacking
Then he discussed JSON hijacking, showing how hackers use remote scripting to read JSON Web services. To defend against this, he said that XMLHttpRequest can see a response and perform operations on it before eval()ing. This frustrates, say, a <SCRIPT SRC> that a hacker might use to point to a JSON Web service and harvest the data that comes back. With this defense, the script is foiled. Then you make the JSON response nonvalid JavaScript. XHR (XMLHttpRequest) removes it, and <SCRIPT SRC> fails.
In general, Hoffman says that if you want to secure AJAX applications you must do six things:
- Perform authentication/authorization checks on both Web pages and Web services.
- Group code libraries by function.
- Validate all input for your application, including HTTP headers, cookies, query string and POST data.
- Verify data type, length and format.
- Always use parameterized queries.
- Always encode output appropriately.
He wound up by touting the new book he coauthored, Ajax Security. He certainly made a case for AJAX developers thinking long and hard about this topic.
Proposals for articles and tips for news stories, as well as questions and comments about this publication, should be submitted to David Nagel, executive editor, at dnagel@1105media.com.
Cite this Site
copy text (above) for proper citation
