Are asp.net AJAX page methods very secure?

Question

We're currentlly thinking about secureity in our applications.

Our preferred method of getting data from the back end is to use jQuery AJAX functions to directly access .aspx pages with page methods on them (without using a scriptmanager), as described brilliantly by Dave Ward here...

http://encosia.com/2008/05/29/using-jquery-to-directly-call-aspnet-ajax-page-methods/

So, my question is, how secure is this?

I've read a bit about XSS and same origin policies etc. Are these all automatically handled by ASP.NET or do we have to explicitly do something to make our apps safe?

Thanks, Jon

Answer 1

ASP.NET won't automatically escape XSS or set cookies to prevent against CSRF, you'll need to

Wikipedia has good pages on both: http://en.wikipedia.org/wiki/Cross-site_scripting http://en.wikipedia.org/wiki/CSRF

Microsoft has an article on preventing CSS, but I couldn't turn up a todo for dealing with CSRF.