• 1
• 2
• 3
• 4
• 5

access active addition ajax application applications approach article asynchronous attack attacker attackers attacks avoid avoiding based blacklisting blogs browser browsers built bypass case characters check checking client code common computer computing content contents context cookies cross current dangerous data detect developer developerworks development discuss document documentdomain documents dom domain domains dr dynamic dynamically eval events execute exploit expression find format function gmxmlhttprequest greasemonkey html http ibm iframe improve information input interaction javascript jpibmcom json key keyboard laboratory language learn level libraries library links listing logger major making malicious mashup member message modify mouse multiple myspace note object online open origin originators page part parts party passwords phd plain policy potentially practices presentation programming property provide proxy rate read received recommended reflected regular related remote request research researcher resources result results rfc science script scripting scripts search secure security send sensitive server servers service services set shown shows side similar simple single site sniffer special staff stealing string style stylesheet subset tag technical technologies technology text threats tokyo tools top trademarks tree trusted type types understanding university uramoto url user users validation var vulnerabilities vulnerability vulnerable warning ways web whitelisting windows worm wwwabccom xml xmlhttprequest xss

Keyword Cloud Navigation Map

Level: Intermediate

Sachiko Yoshihama ([email protected]), Research Staff Member, IBM
Dr. Frederik De Keukelaere ([email protected]), Postdoctoral Researcher, IBM
Dr. Michael Steiner ([email protected]), Research Staff Member, IBM
Dr. Naohiko Uramoto ([email protected]), Research Staff Member, IBM

Ajax is built on Dynamic HTML (DHTML) technologies, including these most common ones:

• JavaScript: JavaScript is a scripting language commonly used in client-slide Web applications.
• Document Object Model (DOM): DOM is a standard object model for representing HTML or XML documents. Most of today's browsers support DOM and allow JavaScript code to read and modify the HTML content dynamically.
• Cascading Style Sheets (CSS): CSS is a stylesheet language used to describe the presentation of HTML documents. JavaScript can modify the stylesheet at run time, allowing the presentation of the Web page to update dynamically.

In Ajax, client-side JavaScript updates the presentation of a Web page by dynamically modifying the DOM tree and the stylesheet. In addition, asynchronous communication, enabled by the following technologies, allows dynamic updates of data without the need to reload the entire Web page:

• XMLHttpRequest : XMLHttpRequest is an API that allows client-side JavaScript to make HTTP connections to remote servers and to exchange data, such as plain text, XML, or JavaScript Serialized Object Notation (JSON).
• JSON: JSON, as proposed in Request for Comments (RFC) 4627, is a lightweight, text-based, language-independent, data-interchange format. It's based on a subset of the ECMAScript language (making it part of the JavaScript language), and it defines a small set of formatting rules to create a portable representation of structured data.

Note that there are other commonly used alternatives for JSON in Ajax applications, such as XML and unformatted plain text. We chose to discuss JSON here, since it has some security implications that we'll examine later in this article.

Read Full Tutorial...