Javascript Injection Security Concerns

[jgd1234567]

Hi, i've always taken security for granted in my websites but i am currently in the process of building a big website where security is of major importance. I understand most of the server side security concerns such as sql injection but with javascript (and ajax) i get a little bit lost. From my understanding there are a couple areas which particularly concern me.

1. What can a user do if they manage to inject javascript into a page on the site? I read that XMLHttpRequest has its own built in security (can only call pages on the site it resides) but if a user can inject javascript into my site then surely this could be a security concern.
2. What are the security concerns with iframes (pages on external site)? Do i get the same problems as in point 1?

I know i should probably html encode my user input but i am just wondering what are the security concerns incase.

 

[BabyJeffy]

Here is a very recent book on the subject. Given the size of the project, the cost of a new book is negligent .

Ajax Security by Billy Hoffman:

http://www.amazon.com/Ajax-Security-Billy-Hoffman/dp/0321491939

Cheers,
Jeff

[tt]Jeff's Blog [!]@[/!] CodeRambler

http://www.coderambler.com/

http://www.coedit.co.uk/

[/tt]

Make sure your web page and css validates properly against the doctype you have chosen - before you attempt to debug a problem!

FAQ216-6094

 

[mmerlinn]

negligent" ?????

mmerlinn

http://mmerlinn.com

"Political correctness is the BADGE of a COWARD!"

 

[BabyJeffy]

> negligent (in the context I meant it) - costs very little.

Cheers,
jeff

[tt]Jeff's Blog [!]@[/!] CodeRambler

http://www.coderambler.com/

http://www.coedit.co.uk/

[/tt]

Make sure your web page and css validates properly against the doctype you have chosen - before you attempt to debug a problem!

FAQ216-6094

 

[mmerlinn]

I checked this dictionary:

http://www.merriam-webster.com/dictionary/negligent

And I am still confused.

What dictionary are you using?

mmerlinn

http://mmerlinn.com

"Political correctness is the BADGE of a COWARD!"

 

[BabyJeffy]

...What dictionary are you using?

Well... you see... it goes like this... I knew what the word sounded like - and it looked ok when I typed it

The word that I meant to use was actually [!]negligible[/!]

Anyway, the reviews I have read (and from what I have read of the book so far) lead me to believe that this is a very useful book on just the subject material you are asking.

Cheers,
Jeff

[tt]Jeff's Blog [!]@[/!] CodeRambler

http://www.coderambler.com/

http://www.coedit.co.uk/

[/tt]

Make sure your web page and css validates properly against the doctype you have chosen - before you attempt to debug a problem!

FAQ216-6094

 

[jgd1234567]

Ok cheers guys. My English sucks so i'm not going to argue. I'll see if can get myself one of them books i guess.

 

[mmerlinn]

Thanks Jeff.

Now it makes sense to me.

mmerlinn

http://mmerlinn.com

"Political correctness is the BADGE of a COWARD!"