» tagged pages
» logout

sorted by: recent | see : popular
Content Tagged with security + JavaScript

Security issues in JSON

JSON involves security vulnerabilities that simply never come up in Ajax, which sends data as XML data rather than sending it as executable Javascript code!

json: del.icio.us/tag/json

Mozilla and Web Services

Did you know that you can access soap services via the Firefox browser? Neither did I. I don't like soap much, but getting an api in something we can program easily helps any technology. It also sounds like a huge security concern for anyone on the platform. Otherwise it's an interesting tool for developing interesting apps.

XML: del.icio.us/tag/xml

http://slbsoftware.com/jsLit/jsLit.js

parses JSON literals without using eval()

json: del.icio.us/tag/json

Xsstc: Cross-site scripting through CSS | tralfamadore.com

There are a couple of popular workarounds: (1) using the hash (#) portion of the URL, which can be read between frames, and (2) cross-domain JSON, or in other words, directly importing live scripts from a third party site into your own.

json: del.icio.us/tag/json

robubu : Safe JSON

We have been investigating the security implications of having a JSON api in Connections. It turns out that it is very easy to leave pretty big security exposures in an application if it isn’t done right. The security exposure in this case is rogue sites being able to get at data made available via a JSON api. The truly frightening part of this is that applications installed on a corporate intranet can actually leak data to internet sites should a user visit a rogue site. BTW, these exposures apply equally to both formally published api’s such as Yahoo’s and also any internal JSON api’s often used for AJAX tricks.

json: del.icio.us/tag/json

JSON is not as safe as people think it is - Joe Walker

There are 2 problems. CSRF (Cross Site Request Fogery) allows attackers to bypass cookie based authentication. I blogged about it a while ago. Wikipedia talks about it. CSRF allows you to invoke cookie protected actions on a remote server. It allows Mr. Evil to trick Mrs. Innocent into transferring money from her bank account into his. Far less known perhaps, is the JSON/Array hack that allows a user to steal JSON data on Mozilla and any other platform with a modern JavaScript interpreter.

json: del.icio.us/tag/json

6 Deadly AJAX Drawbacks: Are you aware?

Some developers view AJAX as the silver bullet for every scenario. However, AJAX introduces its own set of hazards in various areas, which include: development time, browsing history and experience, search engine interaction, accessibility, server load, and security. Let’s take a closer look at each of these 6 areas.

technology: dzone.com: tech links

Password authentication without revealing your password

The majority of personalized web sites use some kind of form-based password authentication where you have two form fields for username and password, and a login button. When you submit your authentication, the password is sent to the server for verification against a user database. This method has several security implications, and my article describes a possible solution to this, using JavaScript.

technology: dzone.com: tech links

Firefox Security Bookmarklets

more bookmarklet hacking from my favourite XSS guy

Firefox: del.icio.us/tag/firefox

MooTools 1.2 Image Protector: dwProtector

Webページの画像をユーザが保存しにくいようにするライブラリ。こういうのはただユーザの心証を悪くするだけなんだけど、まだニーズがあるのかも。

mootools: del.icio.us/tag/mootools

SitePen Blog " window.name Transport

Cross-domain data transfer with window.name and the Dojo framework

Dojo: del.icio.us tag dojo

ADsafe

JavaScript, the programming language of the web browser, is not a secure language. Any script in a page has intimate access to all of the information and relationships of the page. This makes use of mashups and scripted advertising unacceptably risky.

json: del.icio.us/tag/json

Page 1 | Next >>