sorted by: recent | see :
popular
Content Tagged with security + JavaScript
Security issues in JSON
JSON involves security vulnerabilities that simply never come up in Ajax, which sends data as XML data rather than sending it as executable Javascript code!
Mozilla and Web Services
Did you know that you can access soap services via the Firefox browser? Neither did I. I don't like soap much, but getting an api in something we can program easily helps any technology. It also sounds like a huge security concern for anyone on the platform. Otherwise it's an interesting tool for developing interesting apps.
Security
xml
JavaScript
Firefox
opensource
webservices
mashup
http://slbsoftware.com/jsLit/jsLit.js
parses JSON literals without using eval()
Xsstc: Cross-site scripting through CSS | tralfamadore.com
There are a couple of popular workarounds: (1) using the hash (#) portion of the URL, which can be read between frames, and (2) cross-domain JSON, or in other words, directly importing live scripts from a third party site into your own.
robubu : Safe JSON
We have been investigating the security implications of having a JSON api in Connections. It turns out that it is very easy to leave pretty big security exposures in an application if it isn’t done right. The security exposure in this case is rogue sites being able to get at data made available via a JSON api. The truly frightening part of this is that applications installed on a corporate intranet can actually leak data to internet sites should a user visit a rogue site. BTW, these exposures apply equally to both formally published api’s such as Yahoo’s and also any internal JSON api’s often used for AJAX tricks.
JSON is not as safe as people think it is - Joe Walker
There are 2 problems. CSRF (Cross Site Request Fogery) allows attackers to bypass cookie based authentication. I blogged about it a while ago. Wikipedia talks about it. CSRF allows you to invoke cookie protected actions on a remote server. It allows Mr. Evil to trick Mrs. Innocent into transferring money from her bank account into his. Far less known perhaps, is the JSON/Array hack that allows a user to steal JSON data on Mozilla and any other platform with a modern JavaScript interpreter.
6 Deadly AJAX Drawbacks: Are you aware?
Some developers view AJAX as the silver bullet for every scenario. However, AJAX introduces its own set of hazards in various areas, which include: development time, browsing history and experience, search engine interaction, accessibility, server load, and security. Let’s take a closer look at each of these 6 areas.Password authentication without revealing your password
The majority of personalized web sites use some kind of form-based password authentication where you have two form fields for username and password, and a login button. When you submit your authentication, the password is sent to the server for verification against a user database.
This method has several security implications, and my article describes a possible solution to this, using JavaScript.Firefox Security Bookmarklets
more bookmarklet hacking from my favourite XSS guy
MooTools 1.2 Image Protector: dwProtector
Webページの画像をユーザが保存しにくいようにするライブラリ。こういうのはただユーザの心証を悪くするだけなんだけど、まだニーズがあるのかも。
mootools: del.icio.us/tag/mootools
Web
Security
Library
JavaScript
protection
protector
mootools
SitePen Blog " window.name Transport
Cross-domain data transfer with window.name and the Dojo framework
ADsafe
JavaScript, the programming language of the web browser, is not a secure language. Any script in a page has intimate access to all of the information and relationships of the page. This makes use of mashups and scripted advertising unacceptably risky.
Page 1 | Next >>