Does AJAX change security best practices?
No. If a web application has vulnerabilities, it will be insecure no matter what techniques are used to develop it. If a web application is well designed, no amount of “insecure AJAX” will reduce its security posture. Following are five tips for securing Web applications: • Secure by design. Start secure and stay secure by including security as a component in each stage of the software development lifecycle. • Rock-solid input validation. Never trust the client, ever. • Use reliable software libraries. From encryption to session management, it’s best to use components that are tried and thoroughly tested. No need to reinvent the wheel and repeat the mistakes of others. • Secure configuration. Every component of the website should be configured with separation of duties, least privilegeMH, unused features disabled, and error message suppressed. • Find and fix vulnerabilities. Continuous vulnerability assessments are the best way to prevent attackers from accessing corporate and customer
