如何防止修改AJAX请求

Question

Does anybody have any idea how to prevent AJAX request hijacking / modifying?

As javascript is public in website source, is it possible to manipulate the sent data, fi ?.

$.ajax({
    url: endpoint/url,
    data: {
        id: 523658,
        fragile_data: 'it should stay constant'
    }
});

Answer 1

Since you have no control over the client side, never trust the client side .
All you can (and have to) do is to validate data on the server side and probably to authenticate users.

Answer 2

There isn't a way

As part of standard security principle, you should always assume that any information coming from the client cannot be trusted. It must first be passed through a filter and checked to make sure it meets a certain specification. For example, if you ask for an email address and password, you should always encode the field before sending and then check the field server-side to be sure it actually meets an email address syntax. You should also trim it of any extra characters so that you don't fall victim to one of the classic blunders such as

test.user@email.com"; DROP TABLE Users; --

The same applies to AJAX requests. Always sanitise your inputs and always check that any IDs coming back are legitimate (and possible match to a lookup item if they are supposed to).

If you are short on time , there are a bunch of external plugins or frameworks you can get that are free and open source to help prevent attacks on fields such as client-side validators (make sure an email is in a field before it's submitted etc.) as well as checking items server-side to prevent against XSS and SQLi attacks and the likes of. These plugins won't be perfect, but they'll do a large portion of the work for you and allow you to speed up the process a little