Web Info & Tutorials

Joe Walker has an idea for CSRF protection. Will it work?

There are several ways to forge a request in a CSRF attack: iframe, script tag, image tag, scripted window.open() etc. As far as I know XHR is not one of these, because cross-domain rules kick in before the request is sent and not when the reply is read.

Both iframe and XHR will allow you to construct POST requests, the other attack mechanisms are restricted to GET only. With the iframe method, you use some DOM scripting to create a form that points to an iframe. This implies that only form-formatted data can be sent over an iframe POST request.

So in the Ajax world, it might be possible to have a CSRF-safe application that works simply by insisting on POST, and denying anything that is application/x-www-form-urlencoded. Clearly this technique won’t work for non Ajax requests because it requires the browser to use XHR.

Raphael Bauduin has been playing with the Javascript prototype member in order to get an Understanding of Javascript’s prototype member.

After he saw Doug Crockfords Advanced JavaScript presentation he cracked open Rhino and started playing.

Take a peak at the ride:

Jim Yagmin has created a recreation app that uses Ajax titled the Shakespeare Sonnet Shake-up.

The place allows users to rearrange the lines of Shakespeare’s sonnets to create a “sonnet remix” - an all newborn poem cursive using lines crossways some of Shakespeare’s sonnets. The information understands the fit plot of a sonnet, and module exclusive exhibit matched rhymes where appropriate. A recreation agency for would-be poets, students of the sonnet form, and some follower of Shakespeare!

Yahoo! has a new service called Pipes that aims to make it easy to build mashups:

Pipes is a hosted service that lets you remix feeds and create new data mashups in a visual programming environment. The name of the service pays tribute to Unix pipes, which let programmers do astonishingly clever things by making it easy to chain simple utilities together on the command line.

The UI is a rich Ajax application using YUI of course. It is the kind of UI that feels like Flash, but then you do a view source and you see:

Is Maxwell the codename?

We are seeing more and more applications in this domain (e.g. Ning, and other systems coming up).