OWasp AJAX Security Cheat Sheet Flashcards
Real time AJAX security evaluation for learners based on content at https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet
Client Side
What should be used instead of .innerHTML to prevent XSS problems?
Use .innerText, as it automatically encodes the text.
Client Side
Why should eval() or similar code evaluation tools be avoided?
eval() is considered harmful and usually signals a design problem.
Client Side
What does canonicalizing data to the consumer involve?
Encoding data before use to preserve logical meaning and prevent injection issues.
Client Side
Why is proper encoding important when building outputs like HTML, CSS, or JSON?
To ensure data is secure and retains its intended logical meaning.
Client Side
Why should client-side logic not be relied upon for security?
The user controls client-side logic and can manipulate it using browser plugins or other tools.
Client Side
What must be done with business logic to prevent bypasses?
Duplicate all critical business rules/logic on the server side.
Client Side
Why should writing serialization code be avoided?
Even a small mistake can lead to major security issues, and there are existing frameworks for this purpose.
Client Side
How should XML or JSON be built to prevent injection bugs?
Avoid building them dynamically or use encoding libraries or safe JSON/XML libraries to ensure safety.
Client Side
How can XSS and SQL injection be mitigated in data handling?
Encode and validate data properly, using safe libraries and frameworks.
Client Side
Why should secrets never be transmitted to the client?
Anything sent to the client can be accessed by the user.
Client Side
Where should encryption be performed?
On the server, using TLS/SSL for secure transmission.
Client Side
Why should security-impacting logic never be performed on the client side?
To avoid the risk of manipulation or bypasses, keeping security logic server-side ensures better protection.
Server Side
What should be used to prevent CSRF attacks?
Implement Cross-Site Request Forgery (CSRF) protection as detailed in the CSRF Prevention cheat sheet.
Server Side
How can JSON hijacking in older browsers be mitigated?
Review AngularJS’s JSON Vulnerability Protection mechanism and ensure JSON responses start with an object.
Server Side
Why should JSON strings begin with an object?
It prevents exploitation by ensuring responses are not wrapped in an array, e.g., {“result”:[…]} is safe, whereas [{“key”:”value”}] is not.
Server Side
Should server-side serialization code be written manually?
No, use an existing library that has been reviewed for security.
Server Side
What should be done to input when services are called directly by users?
Validate inputs as though they are under user control, because they are.
Server Side
Why avoid manually building XML or JSON?
Manual creation can lead to security issues like injection bugs; use a framework or a safe library instead.
Server Side
What should be used to validate web services?
JSON and XML Schema, validated through a third-party library.
