Agenda 1.What is Rich User Experience? 2.Rich Internet Application (RIA) Technologies 3.AJAX: Real-life examples & Usage cases 4.What is and Why AJAX? 5.Technologies used in AJAX 6.Anatomy of AJAX operation 7.XMLHttpRequest Methods & Properties 8.DOM APIs & InnerHTML 9.AJAX Security 10.JavaScript debugging tools 11.Current issues and Future AJAX Security: Server Side • AJAX-based Web applications use the same server- side security schemes of regular Web applications > You specify authentication, authorization, and data protection requirements in your web.xml file (declarative) or in your program (programatic) • AJAX-based Web applications are subject to the same security threats as regular Web applications > Cross-site scripting > Injection flaw Page 56 56 AJAX Security: Client Side • JavaScript code is visible to a user/hacker > Hacker can use the JavaScript code for inferring server side weaknesses > Obfustication or compression can be used • JavaScript code is downloaded from the server and executed (“eval”) at the client > Can compromise the client by mal-intended code • Downloaded JavaScript code is constrained by sand-box security model > Can be relaxed for signed JavaScript