Is there an application security flaw when using AJAX?

Question

I am a programmer HTML/CSS/PHP a few years and by incredible and more impossible it seems, I’m just entering the world of Javascript with jQuery and AJAX now. My question is whether the security level is affected by passing parameters by AJAX as the source code of the javascript is exposed if we do not decide to encrypt it in any way.

When for example we have to pass parameters to PHP through the AJAX, unless we switch the variables inside the PHP, they are kind of discovered already in the passage of paramenters in the AJAX besides that the urls, at least I for lack of knowledge, beginner, I have passed the urls absolute archives.

How dangerous is that? To what extent would it affect system security? Remembering that this question is not based on wanting opinions but on technical grounds that explain the same.

Answer 1

The general rule is: never trust anything that comes from the client’s side.

All input that is done by javascript has to be checked on the server side. Only when running PHP can you do the checks you need to avoid code injections.

Do what you can on the javascript side, and what is useful to the user, but then keep the house well and handle the data properly, especially if there is a database that will receive this data.

Answer 2

My question is whether the security level is affected when passing parameters by AJAX since the javascript source code is exposed [...]
The variables inside PHP, they are kind of discovered already in the passage of paramenters

It’s not a problem that deserves attention.
I will just add a few points comparing a Request Ajax using GET and POST method.

---

1) A common form, independent of AJAX, always has the accessible elements, you can see the names of the fields including changing them.

$.ajax({
        url  : 'page.php',
        type : 'POST',
        data : { nome : 'Papa Charlie' }
        ...
    });

2) Using AJAX as GET simulates a request with parameter exposed in the URL:
www.dominio.com/page.php?name=Papa Charlie

$.ajax({
        url: 'page.php',
        type: 'GET' ,
        data: 'nome = Papa Charlie',
        ...
});

---

That is, in the POST method you have a form where the fields can be read and edited, and in the GET method you have the simulation of a URL, and both the identification of the parameters is visible. Regardless of the use of AJAX in your application, parameters are always available

No need to change the names in PHP, just check to ensure that the received values ARE of the expected type.

Answer 3

Agreeing with the 'Rgio' answer.... My answer is to introduce the "session" in the answer.

It is not recommended nor to carry out from the security point of view pass sensitive information from php to ajax and vice versa... Enhancing sensitive information.

Even with "https" communications that introduce a higher level of security, nothing is safe.

For this purpose and in response to the question, all sensitive information can never or should leave the jurisdiction of the server or the server cluster depending on the situation. Whenever possible use the session to store one or another field, or use the database between calls as it is in fact the only place where the information will remain persistent.

The system must also contemplate checks on who performs any call Ajax... Denying those who make a call outside the scope of the application and for this there are several solutions such as a Token for each call.

Ps: the POST method always. when security is a concern.