ajax hacking,php - Question regarding Ajax Hacking - Stack Overflow

懒汉之

于 2021-08-06 15:18:12 发布

阅读量98

点赞数

文章标签： ajax hacking

本文探讨了Ajax请求中的URL是否接受绝对路径，以及Same-Origin Policy如何限制JavaScript的安全性。攻击者可以制造任意HTTP请求，但无法获取响应。网站的安全性取决于其对URI的访问控制。应确保通过JavaScript访问的URI与直接浏览器请求的安全检查一致。

摘要由CSDN通过智能技术生成

My Question is does "url" attribute in the ajax request above take absolute path?

The Same Origin Policy prevents JavaScript from making a request and reading the response unless it is to the same host, port and protocol.

That doesn't stop an attacker from making any HTTP request they like (it is trivial to construct one manually that looks the same as one made via JS) and it doesn't stop an attacker from tricking a user into making any request the attacker likes (it does stop the attacker getting the response to that request though).

There is no need for the attacker to involve PHP or any other server side language to do any of this.

Also, is it possible to break any site by sending such requests?

That depends on how the site is written. You should apply the same security checks on URIs designed for access via JavaScript as those designed for access with a direct request from the browser.