Re: Securing AJAX requests with PHP?

On Oct 19, 7:38 pm, phps...@xxxxxxxxx ("Bastien Koert") wrote:
On Sat, Oct 18, 2008 at 11:28 AM, Jay Moore <jaymo...@xxxxxxxxxxxx> wrote:
Yeti wrote:

Ok, but how safe are tokens?
Thinking of man in the middle attacks they do not make much sense, do
they?

That's what I was thinking too.   If I'm deleting an entry from a database
with AJAX, I don't want someone looking at my Javascript and saying, "Hmm,
all I need to do is pass this info to this URL and I can delete at will.."

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit:http://www.php.net/unsub.php

True, but then my permission / auth / workflow schema defines all that. the
user won't like have that permission, the request will be logged and nothing
is ever deleted from the app in any case since I only allow soft (record
level flag ) deletes to ensure data integrity

--

Bastien

Cat, the other other white meat

A complement:

When authenticating users, always assign a new id after they
authenticate using session_regenerate_id()
http://br2.php.net/manual/en/function.session-regenerate-id.php

Alex
.

Relevant Pages

  • Re: downloading problems
    ... Try a System Restore. ... saying i may not have permission to do this. ... Also My javascript is missing ...
    (microsoft.public.windowsxp.customize)
  • Re: Ping Enzo
    ... are you saying that everything you have seen at ... permission granted by the copyright owner for it to be there ... I only viewed the movie and I didn't ...
    (uk.media.tv.misc)
  • Re: "Full Disclosure"
    ... He's saying "if I permit people to do X, then I have to spend time ... they aren't part of the request, and they aren't things he would have ... to do in order to grant people permission or share the source. ...
    (rec.games.bridge)
  • Re: Sol 9 and Pioneer A07 dvd writer
    ... but apparently what I though Mr. Schilling was not ... saying what I though he was saying. ... On very limited testing it seems to be working fine on my ... Once he gets around to giving me permission to run the un-crippled version I ...
    (comp.unix.solaris)
  • Re: javascript and server socket
    ... HTML does not execute anything. ... This is script code, executed by the JavaScript engine. ... The script can request permission, and it can ...
    (comp.lang.javascript)