Making an Ajax Handler, need to ask some security questions
up vote
2
down vote
favorite
I have a website where logged in users can follow other users, each user is stored in a MySQL database, in this database there is a table that has each user session, when a user logs in, it generates a unique session ID for that device and stores it in the users browser as a cookie.
When a user clicks the HTML button on a webpage to follow another user, I want it to send a javascript XMLHttpRequest to this PHP file I'm making, however I'm not sure what kind of security measures to take, currently I require the ID of the user to follow/unfollow and the unique session id cookie value of the logged in user.
Basically, this "cookie"/session with the unique id, I want to know if it's good enough for doing ajax calls, it's kinda like a REST API, however, it can make changes to the database via PHP when the method is POST.
If you can think of any possible issues with this please let me know, I would sure appreciate it, and if anyone has any tips on making these kinds of Ajax API's please let me know.
Cheers!
javascript php json ajax api
asked Nov 10 at 18:30
Lol Boi
244
add a comment |
up vote
2
down vote
favorite
I have a website where logged in users can follow other users, each user is stored in a MySQL database, in this database there is a table that has each user session, when a user logs in, it generates a unique session ID for that device and stores it in the users browser as a cookie.
When a user clicks the HTML button on a webpage to follow another user, I want it to send a javascript XMLHttpRequest to this PHP file I'm making, however I'm not sure what kind of security measures to take, currently I require the ID of the user to follow/unfollow and the unique session id cookie value of the logged in user.
Basically, this "cookie"/session with the unique id, I want to know if it's good enough for doing ajax calls, it's kinda like a REST API, however, it can make changes to the database via PHP when the method is POST.
If you can think of any possible issues with this please let me know, I would sure appreciate it, and if anyone has any tips on making these kinds of Ajax API's please let me know.
Cheers!
javascript php json ajax api
asked Nov 10 at 18:30
Lol Boi
244
add a comment |
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I have a website where logged in users can follow other users, each user is stored in a MySQL database, in this database there is a table that has each user session, when a user logs in, it generates a unique session ID for that device and stores it in the users browser as a cookie.
When a user clicks the HTML button on a webpage to follow another user, I want it to send a javascript XMLHttpRequest to this PHP file I'm making, however I'm not sure what kind of security measures to take, currently I require the ID of the user to follow/unfollow and the unique session id cookie value of the logged in user.
Basically, this "cookie"/session with the unique id, I want to know if it's good enough for doing ajax calls, it's kinda like a REST API, however, it can make changes to the database via PHP when the method is POST.
If you can think of any possible issues with this please let me know, I would sure appreciate it, and if anyone has any tips on making these kinds of Ajax API's please let me know.
Cheers!
javascript php json ajax api
asked Nov 10 at 18:30
Lol Boi
244
I have a website where logged in users can follow other users, each user is stored in a MySQL database, in this database there is a table that has each user session, when a user logs in, it generates a unique session ID for that device and stores it in the users browser as a cookie.
When a user clicks the HTML button on a webpage to follow another user, I want it to send a javascript XMLHttpRequest to this PHP file I'm making, however I'm not sure what kind of security measures to take, currently I require the ID of the user to follow/unfollow and the unique session id cookie value of the logged in user.
Basically, this "cookie"/session with the unique id, I want to know if it's good enough for doing ajax calls, it's kinda like a REST API, however, it can make changes to the database via PHP when the method is POST.
If you can think of any possible issues with this please let me know, I would sure appreciate it, and if anyone has any tips on making these kinds of Ajax API's please let me know.
Cheers!
javascript php json ajax api
javascript php json ajax api
asked Nov 10 at 18:30
Lol Boi
244
asked Nov 10 at 18:30
Lol Boi
244
asked Nov 10 at 18:30
Lol Boi
244
asked Nov 10 at 18:30
Lol Boi
244
asked Nov 10 at 18:30
Lol Boi
244
244
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.
answered Nov 10 at 18:45
LeonidMew
1449
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.
answered Nov 10 at 18:45
LeonidMew
1449
add a comment |
up vote
0
down vote
While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.
answered Nov 10 at 18:45
LeonidMew
1449
add a comment |
up vote
0
down vote
up vote
0
down vote
While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.
answered Nov 10 at 18:45
LeonidMew
1449
While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.
answered Nov 10 at 18:45
LeonidMew
1449
answered Nov 10 at 18:45
LeonidMew
1449
answered Nov 10 at 18:45
LeonidMew
1449
answered Nov 10 at 18:45
LeonidMew
1449
1449
add a comment |
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53242141%2fmaking-an-ajax-handler-need-to-ask-some-security-questions%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
