about Prototype JavaScript Framework?

[Muhammad Saifuddin]

hi authors,

all these thread are already discussed topics about the Prototype and Scriptaculous libraries. I want to know that this type libraries which are created on javascript language... how far it will be secure for our web application.

I mean by using these libraries some times developer need to manipulate this data by using these libraries from the database layer.

My Question is about the security behalf of using these libraries ?

Thanks in Advance

[David C. Crane]

Hi Saif,

Using Ajax, you are exposing data from the database to the user, just as you are doing so in a classic web application. It's possible to create huge security holes, but also possible to avoid them.

Golden rule: don't validate ONLY on the client. It's a matter of style, judgement and the nature of your app how much of the app logic you write on the client, but always ALWAYS re-check any important stuff on the server. It is possible to meddle around with the Javascript using tools like Firebug and Greasemonkey (which have perfectly valid uses too, I hasten to add!).

Beyond that, use common sense. Set up a Facade layer, and only expose those coarse-grained, high-level functions to the web user, never your actual domain model. (This introduces architectural issues of tight coupling anyway, as well as multioplying the number of potential security risks).

Cheers,

Dave