Spry security (and maybe ajax security)?

Question

Hi there,
I've been used Spry for several sites until now, later i
realized that we can easily request the XML (if use XMLDataSet) by
parsing variable to url directly which would be like this:
http://www.example.com/data_generator.php?var1=x&var2=y
This way was too vulnerable, but in other hand it handy for
developer to ensure their request was acceptable and XML can be
generated.
Is there any way to prevent this? At present i use a session
authentication method for securing XML request, so only user who
have privileges can do the request, otherwise else would fall into
front page (and maybe login page)
That was case if we use dynamic XML (server-side XML
generation), how if we use static XML and no server-side
programming language at all?
Thanks,
Dels

Answer 1

"dels2004" <[email protected]> wrote in
message
news:gm5mcn$mbo$[email protected]..
> I've been used Spry for several sites until now, later i
realized that we
> can
> easily request the XML (if use XMLDataSet) by parsing
variable to url
> directly
> which would be like this:
>
http://www.example.com/data_generator.php?var1=x&var2=y
>
> This way was too vulnerable, but in other hand it handy
for developer to
> ensure their request was acceptable and XML can be
generated.
>
> Is there any way to prevent this? At present i use a
session
> authentication
> method for securing XML request, so only user who have
privileges can do
> the
> request, otherwise else would fall into front page (and
maybe login page)
>
> That was case if we use dynamic XML (server-side XML
generation), how if
> we
> use static XML and no server-side programming language
at all?
Personally I would use a .php extension for static XML files
too,
leveraging the existing session authentication mechanism. The
overhead,
compared to use a .xml extension is very, very small.
Massimo Foti, web-programmer for hire
Tools for ColdFusion, JavaScript and Dreamweaver:
http://www.massimocorner.com