Re: Securing AJAX requests with PHP?
| From: | Bastien Koert | Date: | Sun, 19 Oct 2008 22:38:20 +0000 |
| Subject: | Re: Securing AJAX requests with PHP? | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-282115@lists.php.net to get a copy of this message | ||
On Sat, Oct 18, 2008 at 11:28 AM, Jay Moore <jaymoore@accu-com.com> wrote:
> Yeti wrote:
>
>> Ok, but how safe are tokens?
>> Thinking of man in the middle attacks they do not make much sense, do
>> they?
>>
>
> That's what I was thinking too. If I'm deleting an entry from a database
> with AJAX, I don't want someone looking at my Javascript and saying, "Hmm,
> all I need to do is pass this info to this URL and I can delete at will."
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
True, but then my permission / auth / workflow schema defines all that. the
user won't like have that permission, the request will be logged and nothing
is ever deleted from the app in any case since I only allow soft (record
level flag ) deletes to ensure data integrity
--
Bastien
Cat, the other other white meat