Re: [PHP] Securing AJAX requests with PHP?

On Sat, Oct 18, 2008 at 11:28 AM, Jay Moore <jaymoore@xxxxxxxxxxxx> wrote:

Yeti wrote:

Ok, but how safe are tokens?
Thinking of man in the middle attacks they do not make much sense, do
they?


That's what I was thinking too. If I'm deleting an entry from a database
with AJAX, I don't want someone looking at my Javascript and saying, "Hmm,
all I need to do is pass this info to this URL and I can delete at will."

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


True, but then my permission / auth / workflow schema defines all that. the
user won't like have that permission, the request will be logged and nothing
is ever deleted from the app in any case since I only allow soft (record
level flag ) deletes to ensure data integrity

--

Bastien

Cat, the other other white meat

Relevant Pages

  • Re: permissions on a filesystem
    ... Creating a file and deleting a file are both write operations on the ... said does not distinguish between creating an entry and deleting an ... ACLs /might/ offer what he's looking for - I'm ... standard UNIX permissions set does not allow for such a scenario. ...
    (comp.os.linux.misc)
  • Re: Delete History
    ... > How do I delete one entry from the address drop-down? ... depends on how long the entry has been in History. ... E.g. instead of just deleting a high-level node such as a site ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Move up text
    ... The usual syntax is rng1.Offset ... >I have the following code for deleting an entry on a worksheet:> ... > Set rng1 = rng ...
    (microsoft.public.excel.programming)
  • Re: WIN.INI
    ... properly and I needed to uninstall it but could not do so via Add/Remove ... I had to resort to deleting the program folder from Program ... Now under System Configuration the WIN.INI file shows an entry for this ...
    (microsoft.public.windowsxp.general)
  • Re: [PHP] Securing AJAX requests with PHP?
    ... Yeti wrote: ... Thinking of man in the middle attacks they do not make much sense, ... If I'm deleting an entry from a database with AJAX, I don't want someone looking at my Javascript and saying, "Hmm, all I need to do is pass this info to this URL and I can delete at will." ...
    (php.general)