jQuery Penetration Tests

Question

I'm a little worried about posting information via jQuery. In particular when, in WebForms, I do a call to a WebMethod within my form I can obviously intercept the call and data.

Is there any way to secure this communication or is it a case of write your services in such a manner that they can't be used against you?

If it's the latter, what techniques have others used to secure their WebMethods? I'm more interested in solutions where WebForms and jQuery are being used and where the jQuery call is being made to a WebMethod in the code behind of the actual page.

Answer 1

There is nothing inherently insecure about jQuery that is not present in normal web communication. Jquery submissions are done exactly the same way as any other web request; they are either a GET or a POST.

A normal page request is just as likely to be intercepted as a jQuery request. It doesn't matter if you're using code behinds, JSPs, PHP pages, or Ajax requests... the method of browser-to-server communication is always HTTP, and it is always vulnerable to network snooping.

The only true way to secure web communication is with an encryption layer over the entire communication channel, which is what SSL provides. Anything else is always vulnerable to intercepted communications.