AJAX Security Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T13:54:44Z

Point to the official site

2019-02-11T08:05:26Z

Content Removal

2019-02-11T07:09:13Z

Migration to GitHub

2018-04-07T14:40:38Z

Remove wrong CS category

2017-09-27T20:51:17Z

2016-12-14T15:33:18Z

‎Protect against JSON Hijacking for Older Browsers

2016-11-17T21:18:51Z

‎Don't perform encryption in client side code

2016-02-21T18:41:33Z

2016-02-21T18:39:04Z

‎Protect against JSON/JavaScript Hijacking

2016-02-21T18:38:05Z

‎Use CSRF protection

← Older revision		Revision as of 13:54, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/AJAX_Security_Cheat_Sheet.md AJAX Security Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html AJAX Security Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 1: / Line 1: @@
   __NOTOC__
-<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
+<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
 Please visit [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AJAX_Security_Cheat_Sheet.md AJAX Security Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 1: / Line 1: @@
   __NOTOC__
-<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
+<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-<br/>
+<br />
   __TOC__{{TOC hidden}}
@@ Line 106: / Line 107: @@
 == Authors and Primary Editors  ==
-Til Mas<br/>
+Til Mas<br />
 Michael Eddington
@@ Line 114: / Line 115: @@
 [[Category:Cheatsheets]]
 [[Category:OWASP AJAX Security Project]]

← Older revision		Revision as of 14:40, 7 April 2018
Line 114:		Line 114:
	[[Category:Cheatsheets]]		[[Category:Cheatsheets]]
	[[Category:OWASP AJAX Security Project]]		[[Category:OWASP AJAX Security Project]]
−	~~[[Category:Cheetsheet]]~~

@@ Line 60: / Line 60: @@
 == Server Side ==
-=== Protect against JSON Hijacking for Older Browsers ===
-====  Use CSRF Protection ====
+===  Use CSRF Protection ===
 * [[Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet|Cross-Site Request Forgery (CSRF) Prevention]]
 ==== Review AngularJS JSON Hijacking Defense Mechanism ====

@@ Line 53: / Line 53: @@
 === Don't perform encryption in client side code ===
-Use TSL/SSL and encrypt on the server!
+Use TLS/SSL and encrypt on the server!
 === Don't perform security impacting logic on client side ===

@@ Line 10: / Line 10: @@
 = Introduction =
-There is a complete lack of guidelines for AJAX.  This document will provide a starting point for AJAX security and will hopefully be updated and expanded reasonably often to provide more detailed information about specific frameworks and technologies.
+This document will provide a starting point for AJAX security and will hopefully be updated and expanded reasonably often to provide more detailed information about specific frameworks and technologies.
 == Client Side (Javascript) ==

@@ Line 61: / Line 61: @@
 == Server Side ==
 === Protect against [http://capec.mitre.org/data/definitions/111.html JSON/JavaScript Hijacking] ===
-====  Use [[wiki:Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet|CSRF protection]] ====
+====  Use CSRF Protection ====
-Proper CSRF protection ensures that attackers without access to the same origin as the data returned from the server cannot make the server respond with confidential and use JavaScript Hijacking to access it.
+* [[Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet|Cross-Site Request Forgery (CSRF) Prevention]]
 ==== Always return JSON with an Object on the outside ====