1

How to secure jQuery AJAX request on Client & Server side?

So there will be minimum risk of hack.

On server side we can use https

closed as too broad by Fabian Schmengler, Keyul Shah, Murtuza Zabuawala, Arunendra, Amit Bera Mar 21 '17 at 9:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Exactly like any other request: The rule is "do not trust user data". There is nothing special about AJAX requests. – Fabian Schmengler Mar 18 '17 at 16:10
2

From my experience, we should consider:

On the server side:

  • Check isAjax - isXmlHttpRequest on your controller. This prevents the Ajax controller from accessing directly from Browser.
  • We can add more logic to validate the data. For example, validate the Json data, check logged customer.

See here : vendor/magento/module-customer/Controller/Ajax/Login.php

On the client side:

  • We can use lib/web/mage/storage.js for performing asynchronous GET, POST, PUT, DELETE

  • The data should be JSON string, for example: JSON.stringify({payment: payment})

vendor/magento/module-checkout/view/frontend/web/js/action/set-payment-information.js

return storage.post(
            serviceUrl, JSON.stringify(payload)
        ).fail(
            function (response) {
                errorProcessor.process(response, messageContainer);
            }
        ).always(
            function () {
                fullScreenLoader.stopLoader();
            }
        );

We can read more here: https://www.owasp.org/index.php/AJAX_Security_Cheat_Sheet

Not the answer you're looking for? Browse other questions tagged or ask your own question.