Ajax Security discussion for the OWASP Guide

[Andrew van der Stock <vanderaj () greebo net>]

Hi there,

I am writing a section on AJAX for the OWASP Guide, and since it's so  
shiny, I'd thought I'd run my thoughts past you folks.

1. It's Web Services Lite.

(Spoofing)

Therefore, many of the issues facing unauthenticated web services  
apply to Ajax, too. If you are using AJAX without session management,  
it should be unable to perform any tasks a guest cannot do.

2. Validate like crazy

(Tampering)

Just because the process is hidden from the user, doesn't mean that  
the incoming request is safe to handle without validation. Validate  
all inbound requests properly.

3. SSL when necessary

(Repudiation)

Ajax may not be visible to the user, but it still exposes the user to  
confidentiality attacks if sensitive information is transmitted in  
either direction. Use SSL to protect privacy and integrity, whilst  
realizing that SSL is not "security" in and of itself.

4. POST please

(Information Disclosure)

Again, it's easy to use GET, but this remains in the browser history  
and many intermediate logs.

If the Ajax request allows you to fill in information about another  
user, make sure the caller is authorized to receive that information.  
For example, if you provide an Ajax request to find all posts by a  
user on a forum, make sure the posts are filtered to only include  
those the user would normally be able to see, or if you are writing a  
transaction history query, make sure the query only runs against  
accounts the user has access to.

5. Simple and fast handling

(Denial of Service)

Ajax could be used as a DoS target, particularly, if the requests are  
doing significant chunks of work for unauthenticated clients. Be  
careful about implementing long running tasks, which is a typical  
scenario for Ajax (do something slow behind the user's back, to make  
the page feel fast).

6. Ensure the Ajax path is properly access controlled

(Elevation of privilege)

Ajax is a relatively new technology with many immature  
implementations. Make sure that all requests are properly  
authenticated and authorized to prevent users performing tasks which  
would allow them to become higher privilege users than they already  
are. For example, don't allow Ajax to perform administration tasks  
for just anyone.

--

Thoughts?

thanks,
Andrew