Javascript and Security

[ldiuf]

I heard, just recently, that if a site has Javascript being used on it then that opens the site up to many types of security holes. The more the scripting the worse it is, but I never found out what type of problems this creates.

Is this true or not, if so how badly and in what ways? With everything going on in this world today I'd really like to have all the information on this that you could possibly offer.

Thanks,
Larry:confused:

[jkd]

You are only asking for trouble if you are using Javascript to validate your form and assume it is correct.

i.e. you want to make sure a credit card number is properly formatted, and you assume that the JS you use to validate it will guarentee it is, and on the server side try processing it without even checking it for validity. I can easily rewrite any JS function you use through my location bar, and if you are using bad data on the server, bad stuff can happen.

[ldiuf]

how about for requesting access to a member site? I use one to verify the requests?

[BrainJar]

If you mean server-side JavaScript, or ASP or Pearl or PHP or CGI, etc. then the answer is: it depends.

A web server is just another application. They can have bugs and security vunerabilities. Unlike most applications however, they are connected to a very, very big network.

The best thing to do is to regularly check with the particular vendor for updates or patches for all the software you use on your web servers.

[ldiuf]

I'm talking about client side js