Javascript security

qlithe · Apr 24, 2017

Hey!

I'm currently developing a site in pure jquery, PHP, mysql

I've done all I can think of when it comes to security when it comes to PHP/Mysql but this is actually the first time that I'm using javascript. What should I keep in mind to make my site as protected as possible?

Any answer is appreciated

iomatt · Apr 24, 2017

Javascripts load directly in the browser of the visitor, so there is not a lot to do in terms of security, just be sure your code is protected against XSS and cross site request forgery.

qlithe · Apr 24, 2017

iomatt said:
Javascripts load directly in the browser of the visitor, so there is not a lot to do in terms of security, just be sure your code is protected against XSS and cross site request forgery.

Yes, but what I'm most concerned about is my ajax functions. I use global functions with ajax calls inside, and they can easily be run from the console for example. Can't the user just put the function in an infinite loop and easily create a ddos attack? How am I suppose to protect myself from this?

iomatt · Apr 24, 2017

qlithe said:
Yes, but what I'm most concerned about is my ajax functions. I use global functions with ajax calls inside, and they can easily be run from the console for example. Can't the user just put the function in an infinite loop and easily create a ddos attack? How am I suppose to protect myself from this?

A good way to protect your website against abuse from Ajax calls, would be to implement a server side solution that limit requests based on user IP adress and number of request per minute, for example.

qlithe · Apr 25, 2017

But how do I protect my ajax functions from being abused like this?

Code:

while(true){
myajaxfunction();
}

AneaKr · Apr 25, 2017

qlithe said:
But how do I protect my ajax functions from being abused like this?

Code:

while(true){ myajaxfunction(); }

You could request a token from the server each time a request is made. But beyond this, the previous response by @iomatt (a server-side script that limits the amount of requests) should be more than enough. I wouldn't worry too much in this case.

dbanjo · Apr 25, 2017

What is pure jquery, PHP, mysql?

bl4cksta · May 3, 2017

You can use OAuth on your API endpoints which called by ajax.For more security, you need to code js on a server side.

Javascript security

qlithe

Supreme Member

iomatt

Registered Member

qlithe

Supreme Member

iomatt

Registered Member

qlithe

Supreme Member

AneaKr

Regular Member

dbanjo

BANNED

bl4cksta

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World