0
votes
2answers
183 views

Whats the best way to build a HTML/AJAX site that requires login? [on hold]

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
1
vote
1answer
54 views

How is same-origin policy implemented?

I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla ...
2
votes
2answers
128 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with ...
0
votes
2answers
140 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
9
votes
5answers
1k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
1answer
158 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
0
votes
3answers
337 views

API access question

FIRST, THE SCENARIO We have an internal system that is effectively split into 2 very separate parts across 2 sub-domains, our back-end administrative system for internal access only we will call this ...
3
votes
1answer
2k views

How to generate nonce for Ajax web requests

As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...