Ajax Security Tools

IdaAshley points out the latest from IBM developerWorks' Web development section, which talks about shoring up potential weaknesses in Ajax applications. It follows another recent guide for improving Ajax performance. "In this article, you'll learn about Ajax security tools, which you'll be using to scan for SQL injection and cross-site scripting vulnerabilities; to set a master password; and to restore the state of all windows after crashes. You'll take a look at tools and utilities that ensure that linked Web sites in applications are not on the blocked lists and which prevent hackers from altering browser functionality, defacing Web applications, and achieving malicious results. You'll find these utilities divided into three types within the article: hardening tools, Firefox tools, and Firefox add-ons."

Hardening tool

[Anonymous Coward]

This is a great article, because it's given me exactly what I needed. Thanks to Ajax and IBM, I've already got a hardening tool right here in my hand.

Re:

[Vectronic]

lol

Re:

[Anonymous Coward]

This is a great article, because it's given me exactly what I needed. Thanks to Ajax and IBM, I've already got a hardening tool right here in my hand.

Well-done, destined to become a classic!

N00bs, take note:

1) This is short, and sweet. Not some 3000-line cut-n-paste about someone getting it on in a men's bathroom.
2) It's relevant to TFA, or at least appears to be
3) Punchline/troll is right at the end, which means you're hooked before you realize it. By the time you do, it's too late!

Weakness in Ajax?

[Anonymous Coward]

You lie!

Ajax was second only to Achilles during the Trojan War! And Achilles--oh wait. Perhaps he does have a weakness. But considering that he didn't die while Achilles did, I think we can safely say that when you associate security and Ajax in one sentence you had better be talking about security against Ajax. Ajax is strong, not weak! It is the application programmers that are weak. Let's see them take on the Trojans before they complain about Ajax's weaknesses.

Worst possible application development platform.

[Anonymous Coward]

It's a pity that the web is becoming an application development platform, because it really sucks as an API. Unfortunately all other contenders are either too much like the web (XUL) or proprietary (Silverlight, Flex). Browser security is a bitch with just web pages. Wait until people expect cross-site integration from their web applications...

Re:

[Travis Mansbridge]

What can you do? People want their cake, and to eat it too.

Incidentally, don't make your cakes with Ajax [wikipedia.org]. It will kill you.

HTMLProtector

[efence]

HTMLProtector helps you:

• Prevent visitors from viewing and printing your source code.

Yes! Because it always worked in the 90s! I see no reason why it can't work now!

Re:

[Culture20]

If it turns most of the html into one big gif and an image map then it should "work". Bonus for being just like the 90's!

Re:

[Quantumstate]

It is even better than that. It has javascript password protection. This will naturally keep your site perfectly secure. I thought perhaps this might be a possible one where it could work with some kind of strong encryption actually based on the password. I was disappointed after looking at the trial however since I cracked it by simply using trial and error to remove bits of code until I narrowed it down the the correct bit. Then the page was free for viewing.

And naturally one of the main ways I wou

From TFA...

[slummy]

Homeland Security Threat Levels

This extension displays the current U.S. Homeland Security Threat Level (Severe, High, Elevated, Guarded, and Low) as an icon in the status bar, allowing you to see the threat level at a glance.

Not really sure what this has to do with AJAX security, thanks IBM!

Re:

[deniable]

When DHS raises the level you have to bill your clients for extra security work. If you're a real good consultant, you'll find a way to bill them when it comes back down. IBM thinks of everything.

I wasn't expecting much....

[Anonymous Coward]

But wow, that was fucking terrible.

"Ajax Security"?

[John Hasler]

Isn't that an oxymoron?