AJAX - Security

AJAX Security: Server Side

AJAX-based Web apppcations use the same server-side security schemes of regular Web apppcations.

You specify authentication, authorization, and data protection requirements in your web.xml file (declarative) or in your program (programmatic).

AJAX-based Web apppcations are subject to the same security threats as regular Web apppcations.

AJAX Security: Cpent Side

JavaScript code is visible to a user/hacker. Hacker can use JavaScript code for inferring server-side weaknesses.

JavaScript code is downloaded from the server and executed ("eval") at the cpent and can compromise the cpent by mal-intended code.

Downloaded JavaScript code is constrained by the sand-box security model and can be relaxed for signed JavaScript.