sorted by: recent | see :
popular
Content Tagged with json + Security
When Ajax Attacks! Web application security fundamentals at @media Ajax 2008
Web application security is hard, and getting harder. New technologies and techniques mean new vulnerabilities, and keeping on top of them all is a significant challenge. This talk will dive deep in to the underbelly of JavaScript security, exploring topics ranging from basic cross-site scripting to CSRF, social network worms, HTML sanitisation, securing JSON, safe cross-domain JavaScript and more besides.
SitePen Blog " Security in Ajax
An overview of a large number of important security issues to consider when building AJAX sites.
SitePen Blog " Security in Ajax
A good summary on security in javascript programming.
SitePen Blog " Security in Ajax
A good summary on security in javascript programming.
JSON Hijacking and How ASP.NET AJAX 1.0 Avoids these Attacks - ScottGu's Blog
points how the MS ajax stack on the server side validates and prevents json hijacking. Pushed me towards using ms ajax on the server side (jquery & ms on the client side) instead of rolling our own .ashx to work w/ jquery
html-whitelist
A wrapper around the html5lib library for sanitizing HTML. The service can be invoked using JSON and JSONP.
SitePen Blog " Security in Ajax
JSONに {}&& をプレフィックスする
Session Vars - Session Variables Without Cookies
A small script that let you use JavaScript session variables without using cookies. It will let you store 2 MB of data, with much less hassle than a cookie based solution.
Security in AJAX
Protecting Resources, Explicit Token Validation, Referer Header Checked Validation, JSON Hijacking, HTTP Authentication, Enabling Other Sites to Access Your Resources, OAuth, JSONP Resource Protection, Protecting the Web Page, Subspace, Loading Cross-Site/Untrusted JavaScript, and Dojo Secure
Security in AJAX
Protecting Resources, Explicit Token Validation, Referer Header Checked Validation, JSON Hijacking, HTTP Authentication, Enabling Other Sites to Access Your Resources, OAuth, JSONP Resource Protection, Protecting the Web Page, Subspace, Loading Cross-Site/Untrusted JavaScript, and Dojo Secure
Security for GWT Applications - Google Web Toolkit | Google Groups
It is a sad truth that JavaScript applications are easily left vulnerable to several types of security exploits, if developers are unwary. Because the Google Web Toolkit (GWT) produces JavaScript code, we GWT developers are no less vulnerable to JavaScript attacks than anyone else. However, because the goal of GWT is to allow developers to focus on their users' needs instead of JavaScript and browser quirks, it's easy to let our guards down. To make sure that GWT developers have a strong appreciation of the risks, we've put together this article.
Security for GWT Applications - Google Web Toolkit | Google Groups
It is a sad truth that JavaScript applications are easily left vulnerable to several types of security exploits, if developers are unwary. Because the Google Web Toolkit (GWT) produces JavaScript code, we GWT developers are no less vulnerable to JavaScript attacks than anyone else. However, because the goal of GWT is to allow developers to focus on their users' needs instead of JavaScript and browser quirks, it's easy to let our guards down. To make sure that GWT developers have a strong appreciation of the risks, we've put together this article.
Ajax Vulnerabilities - Simon Willison @ Media Ajax
The main thing to worry about is users injecting Javascript - cross-site scripting (XSS). Other vulerabilities people used to talk about - trusting user input and checking for SQL injection attacks - are boring/easy. If I have an XSS hole, I can steal your users’ cookies and log in as them, show a fake phishing page, embed malware, etc. And any service your site provides, I can perform it as if I was one of your users.
Web 2.0的アプリのセキュリティ:再考「機密情報にJSONPでアクセスするな」 : アークウェブ ビジネスブログ
「クロスドメインアクセスの対策を施していない状態で機密情報を含むJSON、JSONP、JavaScriptでのデータ提供は行ってはいけない」
Page 1 | Next >>