Mixing JQuery Ajax with ASP.NET : is there any security risk

Question

I am using jQuery with ASP.NET in a project. Instead of using ASP.NET Ajax, I am using jquery's ajax functions. Is there any security risk if I do that? I mean, since I am using jquery's ajax calls, no view state information will be passed to the server so that it can verify the page's authenticity (though it saves a lot of bandwidth..).

I would also like to know what is the best/good practice here.

Answer 1

Microsoft has included Jquery in their Visual Studio releases (see: http://weblogs.asp.net/scottgu/archive/2008/09/28/jquery-and-microsoft.aspx)

If there was a big security risk they probably wouldn't have done that ;)

As with al webapplications never trust the input you recieve. It doesn;t matter if you're working with ASP.Net AJAX, Jquery or any other library. Web requests can always be spoofed. Therefor always sanitize the input you recieve and make sure that the user is authenticated (ASP.Net forms authentication uses cookies and not viewstate).

Answer 2

Make sure that you validate all user input. And post basic authentication information to your Web Services (jQuery.ajax has a data parameter), so that no one can use the services without being a part of the system.

Passing along a session GUID and thus providing the Web Service with full authentication, is enough security for most applications (in addition to normal security checks such as input validation). You may specify closer what security level your application needs.

Answer 3

I use the same practice on many case - jQuery ajax on aspx pages

You can check 3 thinks (select 1-2 of them) and be sure that none can create troubles on your site.

1. Send all the post data encrypted (if you can).
2. Send hash value with the post data - and check for the correction of the hash (if you can).
3. Check that the calls is coming from your host on url.

eg, you have a page 'http://www.yourhost.com/askforajax.aspx', check if the url starting with the 'http://www.yourhost.com/'

The hash I mean here, must be your implimation of hash or crc check or what ever you like you can call it.

here is a real ajax call from my pages

doSomeWork.aspx?plist=36&pslst=1&e=1202638085&er=12585795

The last 2 parametres are check parametres.

Also inside the the ajax page that make the calculations check every parameter for be correct.

I also check some other thinks in some cases, for example if a user press a button that make a change somewhere this user must have cookies enabled, so I check if the users cookie hash is the same.

For the url check

I belive that the Request.ServerVariables["HTTP_REFERER"], can do the work of checking from where the request come from.

HTTP_REFERER Returns a string containing the URL of the page that referred the request to the current page using an tag. If the page is redirected, HTTP_REFERER is empty

Hope this help you.