如何使jQuery（javascript）ajax表单数据发送的可读性降低？

Question

Someone using firebug or chrome console could intercept the submitted form data and then switch some of the values, eg. Sender's ID . I was wondering if I can make data sent less human readable so the attacker won't want to deal with it.

I saw something like this:

$.ajax({
    type: "POST",
    url: 'http://www.example.com/widget_category.php',
    data: "p=eyJUcmF6ZW5pUG9qYW0iOiIiLCJJREdydXBhIjoiMzA3IiwiSURQb2RHcnVwYSI6MzA3LCJQcm9kYXZhYyI6IiIsIk9rcnV6aSI6W10sIk9wc3RpbmUiOltdLCJDZW5hT2QiOi0xLCJDZW5hRG8iOi0xLCJTdGFuamFQcmVkbWV0YSI6W10sIk5hY2luaVBsYWNhbmphIjpbXSwiRmlsdGVyIjpbXX0=",
    dataType:'html',
    success: function(res){
        $('#limwidget').empty().append(res);
    }
    }); 

Edit: I see this question was accepted bad. I just want to point out that i am validating all data received on the server side and there should be no question about that, but I just wanted to hide the real sensitive data from database ( and maybe make them also timestamp signed in some manner and different from user to user). I realize that maybe this problem should be considered on server-side(php), that all sensitive data should be swaped on server-side instead of client-side, so we can avoid security by obscurity.

Thanks for clarifying

One more edit: I see now that output from atob function from the example given

eyJUcmF6ZW5pUG9qYW0iOiIiLCJJREdydXBhIjoiMzA3IiwiSURQb2RHcnVwYSI6MzA3LCJQcm9kYXZhYyI6IiIsIk9rcnV6aSI6W10sIk9wc3RpbmUiOltdLCJDZW5hT2QiOi0xLCJDZW5hRG8iOi0xLCJTdGFuamFQcmVkbWV0YSI6W10sIk5hY2luaVBsYWNhbmphIjpbXSwiRmlsdGVyIjpbXX0=

is

{"TrazeniPojam":"","IDGrupa":"307","IDPodGrupa":307,"Prodavac":"","Okruzi":[],"Opstine":[],"CenaOd":-1,"CenaDo":-1,"StanjaPredmeta":[],"NaciniPlacanja":[],"Filter":[]}

so I guess that it's useless to start hiding data on client-side.

Answer 1

You can encode your data to base64 with atob() and btoa(), and then decode it in the server. Be aware that doing this will only obfuscate your code, and won't make it 100% secure.

Here's some info about Base64 encoding for JavaScript.

https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding

Answer 2

They can change anything on the front end even with this change. Everything sent to the client can be read, including any encryption code you use. It is harder potentially but you are confusing obfuscation for security .

Obfuscation will not solve the problem.

You should make it your priority to get your server side code to validate and sanitise the data that comes from the front end.

http://en.wikipedia.org/wiki/Security_through_obscurity

Answer 3

You should forget about having sensitive logic on client side and expect to be safe, there is no way to do that.

Even in case you "ofuscate" the output, that evil user could put a breakpoint before the ofuscation and change values at will.

If you concern is that someone could change the SenderID then, assuming is valid for your scenario, you could validate on server side that SenderID posted is the same that initiated request.

Answer 4

Base64，内容会更长一些，但是得到广泛支持，还有命令行工具可以对其进行解码。

Answer 5

I think it's safest to just assume that all data from the client is evil and add code on your server to validate and authorize where appropriate. You could encode your data and then decode it on the server, but JavaScript encoding/encryption is less useful than you might want. The attacker could always just open the dev console in the browser, inspect your code, and run whichever encryption method you use on their new malicious data.