Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 0 down vote favorite

For a mobile, e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the "checkout" process through an ajax call?

The entire site is presented by making json-formatted ajax-calls to the service (which is controlled).

If the service will return responses ONLY from the client-server (i.e. lockdown on the IP-range) would that make it secure? Are there other considerations?

EDIT:

JSON-based ajax is to give context to the mobile-site setup. Client-server model is more accurate, where the business logic / authorization is handled via another server.

But because it's using JSON-Ajax, the calls are easily read in javascript (or through a http proxy for the transaction). SSL Certificate will be installed. I'm just trying to find out if there are specific security holes to protect against in this setup.

share|improve this question
3  
What does the data representation format have to do with safety? How else would you handle a checkout event in an AJAX app other than than through an XMLHttpRequest? Is comparing IP addresses an adequate safety measure for your app in the first place? We don't know enough to tell. – Kilian Foth Feb 17 '12 at 14:53

1 Answer

up vote 6 down vote accepted

Ajax/JSON/XHP/XHR/$insert_stupid_neologism_here is as safe as vanilla HTTP (because it is vanilla HTTP) if and only if the site is secured with SSL and you use a token system to prevent cross site request forgeries.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.