06.01.06
Securing Your JavaScript Against Evildoers
What with the Ajax invasion and all, JavaScript is once again all over the damn place. The big difference now vs. the ’90s is JavaScript is doing a lot more heavy lifting and — more importantly — interacting with both host server and browser client (i.e. user’s machine) in ways heretofore (mostly) not seen. And that means along with all the cool stuff and wond’rous toys and tools comes a whole new avenue for mayhem by lowlifes, script kiddies, and really gnarly folks like the Russian mafia.
Server-side programmers — at least the good ones — are already atuned the potentially cataclysmic horrors that can be wrought via insertion attack methods, but in javaScript circles — even the upper aeries of guru-dom — awareness of such dangers is not as pronounced. This is bad.
Fortunately, A List Apart is doing its part for responsible web development (as usual) and has posted a good 2-part primer on writing secure JS code by Niklas Bivald:
Community Creators, Secure Your Code!
Community Creators, Secure Your Code! Part II
Let’s hope this is the start of a trend of articles and discussion along these lines.
