2

I am creating a web application that uses JQuery's AJAX calls as it deals with all of the browser inconsistencies.

However, as the code is very much easily readable from the browser I have has concerns about what security measures I can use to protect the web application from attack.

I will be obviously doing authentication checks for the server side code to ensure that they have access to the data that they are trying to access. However, I have also been trying to look into ways of stopping CSRF attacks as well as looking into ways of 'obscuring' the code so it is not easily readable via View Source in the browser.

What steps should I be taking to ensure that security is at a good level?

Also is injecting data into a jquery script via PHP a bad idea?

Thanks!

Daniel West
  • 1,808
  • 2
  • 24
  • 34
  • 3
    [How to secure the Javascript Code?](http://stackoverflow.com/questions/3438923/how-to-secure-the-javascript-code) –  Jan 11 '12 at 15:34
  • 1
    There is no way to secure any code which runs on a remote client machine. You MUST write your client side code to assume that everything send from a user is an attack. Sanitize all your inputs, authenticate the sender, ensure integrity of the request, nonrepudiation, etc. – Daisetsu Jan 11 '12 at 23:38

1 Answers1

2

There's no easy answer to your main question. You should read the OWASP guide on CSRF prevention and go from there.

And there's plenty of options out there for obfuscating javascript, but none of them will increase the security of your code. If an attacker really wanted to read your obfuscated code, he could just pick through it by hand or write a parser for it and simply de-obfuscate it. Not a viable security technique.

Also is injecting data into a jquery script via PHP a bad idea?

As long as you have no problem with the world seeing that data, no it is not a bad idea. If the data is sensitive, you'll probably want to keep it server-side, or hash it with a salt and then insert the hashed value into the script. Of course, this hash is rather unusable client-side because you must not include your salt in anything client-side (this would defeat the purpose of obfuscating the data in the first place). If you want to make use of that data, you'll need to ajax it back to your server and process it there.

Andrew
  • 1,081
  • 1
  • 8
  • 19