Security Issues for Ajax Web Applications While Ajax can greatly improve the usability of a Web application, it can also create several opportunities for possible attack if the application is not designed with security in mind. Since Ajax Web applications exist on both the client and the server, they include the following security issues: • Create a larger attack surface with many more inputs to secure • Expose internal functions of the Web application server • Allow a client-side script to access third-party resources with no built- in security mechanisms The following paragraphs describe these security concerns in more detail.

Increased Attack Surface Unlike traditional Web applications that exist almost entirely on the server, Ajax applications extend across the client and server. Such implementations require a trust relationship between the client and server—a relationship that can be exploited by an attacker.