What is the best way to secure my ajax requests?

[shedokan]

Originally Posted by rnd me

a different website cannot make request to your server using ajax, but a server or remote script request could. you can check the refferer header for a match as well. using post instead of get will cut off all non-user-approved (popup-warning) xdomain client-side IO actions.




a script whose context originates from another site will not have access to your cookies.

Thanks, but what if that script would use a function on my domain, would it count as if it was sent by my domain?

[MattF]

Originally Posted by rnd me

you can check the refferer header for a match as well.

The referer header can't be relied upon though.

[MattF]

Originally Posted by shedokan

Thanks, but what if that script would use a function on my domain, would it count as if it was sent by my domain?

http://en.wikipedia.org/wiki/Cross-site_scripting
http://en.wikipedia.org/wiki/Cross-site_request_forgery

[shedokan]

Originally Posted by MattF

http://en.wikipedia.org/wiki/Cross-site_scripting
http://en.wikipedia.org/wiki/Cross-site_request_forgery

Oh, so they can't use code outside of their Iframe, thanks.
I think I'll use iframes for some apps and have a way for them to put html content that will be checked for security before I'll let them publish their plugins.

If someone would have said so in the first place I would have been less confused.

Thanks for everyone anyway.