Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a mobile e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the "checkout" process through an ajax call?

The entire site is presented by making json-formatted ajax calls to the service (which is controlled). But because it's using ajax, the calls are easily read in Javascript (or through a http proxy for the transaction). SSL certificate will be installed.

If the service only responds to the site (i.e. lockdown on the IP range) would that make it secure? Are there other considerations? Are there specific security holes to protect against in this setup?

share|improve this question
4  
What does the data representation format have to do with safety? How else would you handle a checkout event in an AJAX app other than than through an XMLHttpRequest? Is comparing IP addresses an adequate safety measure for your app in the first place? We don't know enough to tell. – Kilian Foth Feb 17 '12 at 14:53
up vote 7 down vote accepted

Ajax/JSON/XHP/XHR/$insert_stupid_neologism_here is as safe as vanilla HTTP (because it is vanilla HTTP) if and only if the site is secured with SSL and you use a token system to prevent cross site request forgeries.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.