Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm new to web applications. I have developed a web application using ASP.net. After hearing about jquery and going through some examples, I changed the existing application and used jquery to do most of the ajax work. On the server side I used html handlers for db connections and data processing.

Because I'm using jquery, my concern is my script is visible to users of the application. Will this be a security issue? Am i following a right path?

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

jQuery is not a programming language. It is a JavaScript framework. Your AJAX code is not any more visible just because you switched to jQuery. No matter what, AJAX relies on JavaScript in the client, so that code is visible to whomever uses the web application. (Afterall, AJAX stands for Asynchronous Javascript And XML.)

There may certainly be security holes in jQuery. However, chances are there will be bigger holes in what you write. (This isn't meant to put you down, but you are a neophyte. Expect to make mistakes.) jQuery is used by many and programmed by a group of developers. Security is one of the things that is on everyone's minds.

I would worry more about the code I wrote with jQuery then the code that makes up jQuery. Just keep up on the updates and news about it, so that you are aware of any security issues that are identified. And, of course, learn the best practices for creating secure applications.

share|improve this answer
add comment

Any javascript is visible to attackers, that is just the way the web works, browser downloads the script file and then executes it. Making a request for a script file, is the exact same process as making a request for a webpage.

For example, if you are using Google Chrome right now (and for web development you should be using either google chrome or Firefox with firebug installed) hit Ctrl+Shift+J to open up the Developer TOols. You will be able to see everything about this web page. Click the Elements tab, expand the area that says <head> and look in there for any of the script elements, you will see something like this: Script tags in Google Chrome Developer Tools

See those urls in the script tags? Those are the urls that you go to to get that code, you can type them directly into your browser and get those files, this is how all webpages work and the trick is to accept it and program secure code even with your hand showing.

Heck, nowadays it's not that hard to decompile and reverse engineer any application so this is generally a good idea. The only time that someone seeing your code would be a problem is if they can see that you have coded a security bug and honestly, javascript does a decent enough job of minimizing your chances for doing something stupid that if you keep learning, and don't do anything too crazy you will be just fine.

share|improve this answer
add comment

No. JQuery is executed in the browser, an from a security point of view, the browser is always unreliable. No matter how much JavaScript you use or which JS frameworks, it's always under control of the attacker. Security has to implemented on the server side. It's a common mistake beginners make, to place security checks in the JavaScript part and let the server trust it.

share|improve this answer
2  
+1: Website attackers don't have to play nice and use the rendered implementation of your website. They can craft their own requests and attacks to your backend services without ever using a browser. –  Peter Smith Jun 13 '11 at 19:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.