For a mobile, e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the "checkout" process through an ajax call?
The entire site is presented by making json-formatted ajax-calls to the service (which is controlled).
If the service will return responses ONLY from the client-server (i.e. lockdown on the IP-range) would that make it secure? Are there other considerations?
JSON-based ajax is to give context to the mobile-site setup. Client-server model is more accurate, where the business logic / authorization is handled via another server.