Introduction
The advent of Web 2.0 architecture has also led to a rapid increase in AJAX-based web applications. The big mistake some organizations continue to make in these technological times is to perceive that AJAX-based web applications are more secure than ordinary web applications. The truth of the matter is that AJAX technology does not bring with it any security special features. Web applications built using AJAX are just as susceptible to attack just like conventional web applications. This article covers Cross-Site Scripting in AJAX-based web applications.
AJAX
AJAX is a new technology brought about by the Web 2.0 architecture.It connects to the server asynchronously. It makes use of JavaScript, XML, HTML, and CSS to deal with data objects in web applications using XMLHttpRequest. This means that a web application that uses AJAX can easily update specific parts of a web page without having to refresh the entire page. This AJAX capability has its pros and cons since AJAX carries some of its data objects in plain text to and from the server making it vulnerable to attacks such as XSS and CSRF.
XSS in AJAX
XSS can be used in AJAX to manipulate user data if web applications are deployed without sanitizing input and output data streams that the web application deals with. XSS can easily be used to hijack sessions or user identities. All forms of XSS such as Stored, Reflected, and DOM-based XSS can also be exploited on AJAX-based web applications. Developers should ensure that they encode the data before presenting to safeguard the application from possible attacks.
It is important that developers closely check the entire application for any loopholes where XSS can be exploited especially through user input or output from the server. AJAX functions that fetch data from the server may contain XSS entry points which attackers may use to steal information from the user. A browser can be attacked if the developer uses JavaScript functions such as ‘document. write()’ or ‘eval()' which may result in a DOM-based XSS attack.
Since AJAX-based applications are normally used to provide real-time updates such as RSS feed an application can be exposed to XSS attacks if the developer fetches the data from untrusted Web Service APIs and presents the received data without properly filtering and validating it. AJAX applications are also required to check for special characters such as ‘<, >, /’ to avoid malicious code on user input that goes to make requests to the server.
Prevention
- Sanitize XMLHttpRequest data before sending it back and ensure that all proper validations and escaping of characters have been properly implemented.
- Lock invalid requests.
- Check the application for simultaneous logins to protect users from identity theft.
- Not to use functions like ‘write()’ or ‘eval()’.
- Implement Content-Security-Policy to ensure that any XSS attempts are mitigated by allowing data from trusted sources only.
- Replace special characters such as ?, &, /, < with their HTML and URL equivalents to avoid malicious input from users.
Conclusion
Developers and organizations respectively should take note that AJAX-based applications can also be vulnerable to XSS attacks and take time to sanitize and scan their applications for XSS as well as other common vulnerabilities before deploying them. Perhaps developers should take caution on how the XMLHttpRequests are handled and how data is sanitized and scanned before being presented to avoid common XSS attacks.