Buzz-Enabled Security
Hello, everybody. I’ll be filling in while our usual host is away. I’m late to this “blogging” phenomenon you young folks love so much, so please bear with me if my tags aren’t all quite closed yet.
Darknet.org.uk is running an essay called
Application Secure Enough? which, just as one might expect, explores the issue of
security in AJAX-fueled apps.
Most of the ground covered is applicable to any web application. If your habits are good with
regard to vetting user input and tracking user state (cookies, sessions, et alia), you
shouldn’t have to jump through additional hoops to secure your app once you’ve brought AJAX
on board.
Author Navaho Gunleg suggests tagging HTTP transactions with a pseudorandom token
to make them hard to spoof, which is a fine idea. Mr. Gunleg then exhorts the legions of
bored crackers to take advantage of all the poorly secured AJAX apps out there — yours is
not among them, I’m sure.
