javascript

Chapter 17: Ajax and JSON
Even though this is possible, you should avoid using this feature. Storing usernames
and passwords in JavaScript is highly insecure, because anyone with a JavaScript
debugger can view what is stored in the variables, exposing your username and
password in plain text.
Cross - Domain Requests
One of the major limitations of Ajax communication via XHR is the cross - domain security policy. By
default, XHR objects can access resources only on the domain from which the containing web page
originates. This security feature prevents some malicious behavior. However, the need for legitimate
cross - domain access was great enough for solutions to begin appearing in browsers.
Though the cross - domain solutions are different, they have similar goals. The first is to ensure that
cookies are not sent with the request or with the response, because cookie stealing is a major security
risk. The second is to ensure that resources cannot be requested without permission. In short, JavaScript
should never be able to request a resource on a domain without that resource specifically saying it can be
accessed. To that end, IE and Firefox have implemented cross - domain solutions.
The XD omainRequest Object
Microsoft introduced the XDomainRequest (XDR) type in IE 8. This object works in a manner similar to
XHR but in a way that is safe and secure for cross - domain communication. The XDR object implements
part of the W3C Access Control for Cross - Site Requests specification as part of its security approach (this
specification is still under development at the time of this writing, and so may undergo changes in the
future). Here are some of the ways that XDR differs from XHR:
❑
❑
❑
❑
❑
Cookies are neither sent with requests nor received with responses.
There is no access to set request headers other than Content - Type .
There is no access to response headers.
Only GET and POST requests are supported.
XDR can access only resources with a header of Access - Control - Allow - Origin set to *.
These changes mitigate issues related to CSRF and cross - site scripting (XSS) attacks. The resource being
requested can dynamically decide whether to set the Access - Control - Allow - Origin header based on
any data it deems appropriate: user - agent, referrer, and so on. As part of the request, an Origin header
is sent with a value indicating the origin domain of the request, allowing the remote resource to
recognize an XDR request explicitly.
XDR object usage looks very similar to XHR object use. You start by creating a new instance of
XDomainRequest , call the open() method, and then call the send() method. Unlike the open() method
on XHR objects, the one on XDR objects accepts only two arguments: the request type and the URL.
578