When Ajax Attacks!
Web application security fundamentals
Simon Willison, @media Ajax 2008

I’m here to scare you
• XSS • PDF
• CSRF • XBL
• UTF-7 • HTC
• crossdomain.xml • JSON and JSONP

A few years ago...
• Web application security tutorials tended to
boil down to three things:
• Don’t trust input from users
• Avoid SQL injection attacks
• Don’t let people inject JS in to your pages

A few years ago...
• Web application security tutorials tended to
boil down to three things:
• Don’t trust input from users Boring!
• Avoid SQL injection attacks
• Don’t let people inject JS in to your pages

A few years ago...
• Web application security tutorials tended to
boil down to three things:
• Don’t trust input from use