Ajax Security

Been thinking about security...

Security is important in any sort of application like this. It's required if you want people to have confidence that what they're looking at is credible...the best trust metrics in the world are useless if it only takes five seconds to hack a trusted account. But security is a problem with Ajax, particularly the way I want to use it.

For the most part, Ajax has been used on same-site applications to make interfaces more reactive. This is the application on Google Maps, The Pool, etc. I haven't really seen Ajax used much with external xml files, which was really the whole point of the xmlhttprequest function in the first place. And I've never seen Ajax used in a content injection system (or anything else) where things like user accounts are hosted on a different server than the page running the Ajax script. This combination of bookmarklets and Ajax leads to some interesting problems:

• You can't use cookies, since the domain the script is running on isn't always going to be the same. (Though, this leads me to wonder if you can read cookies from other sites using a bookmarklet and send their contents to your server through Ajax...talk about security issues!)
• You can't use session variables, because Ajax requests aren't really invoking a session on the server you're pulling data from.
• You have to assume that whatever data or script you load through Ajax will be exposed to whatever script the host page is running. So, really, this means that anything you're running through Javascript is inherently unsecure.

That last one is the killer. I can think of ways around a lack of cookies and sessions, even without giving in to the temptation of just making people log in every time they want to do something. But you have to run input and authentication through Javascript. What if Foxnews decides to reverse engineer my Ajax, determine what variables I'm using to store login names, passwords, and input text, and just adds a function to their pages that fires every second and clears those variables? Obviously, this is a simple attack, and there are ways around it, but the point is that all of my working data in Javascript is exposed to any site where a user clicks on their bookmarklet. In a worst-case scenario, this means Joe Haxxor can make a blog, throw in a Javascript that collects authentication data, and then take over the account of anybody that uses their Re:Poste bookmarklet on that page. Ugh.