{"id":2342,"date":"2005-08-28T12:38:57","date_gmt":"2005-08-28T20:38:57","guid":{"rendered":"http:\/\/photomatt.net\/2005\/08\/28\/ajax-and-xss\/"},"modified":"2005-08-28T12:38:57","modified_gmt":"2005-08-28T20:38:57","slug":"ajax-and-xss","status":"publish","type":"post","link":"https:\/\/ma.tt\/2005\/08\/ajax-and-xss\/","title":{"rendered":"AJAX and CSRF"},"content":{"rendered":"<p>When working on some new AJAX features for <a href=\"http:\/\/bbpress.org\/\">bbPress<\/a> and <a href=\"http:\/\/wordpress.org\/\">WordPress<\/a> we&#8217;ve noticed that AJAX requests don&#8217;t seem to send HTTP_REFERER values. We check referrers as one level of protection against cross-site-scripting, or XSS, so when they&#8217;re not set we aren&#8217;t able to use that value. How are most people using AJAX protecting against XSS? It seems the same things we&#8217;re doing to make things easily accesible in a dynamic fashion are also opening new vectors for attack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When working on some new AJAX features for bbPress and WordPress we&#8217;ve noticed that AJAX requests don&#8217;t seem to send HTTP_REFERER values. We check referrers as one level of protection against cross-site-scripting, or XSS, so when they&#8217;re not set we aren&#8217;t able to use that value. How are most people using AJAX protecting against XSS? &hellip; <a href=\"https:\/\/ma.tt\/2005\/08\/ajax-and-xss\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">AJAX and CSRF<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"fullscreen","default_image_id":54207,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false},"categories":[34],"tags":[39,44,43,41],"class_list":["post-2342","post","type-post","status-publish","format-standard","hentry","category-wordpress","tag-ajax","tag-csrf","tag-security","tag-web-development"],"parsely":{"version":"1.1.0","canonical_url":"https:\/\/ma.tt\/2005\/08\/ajax-and-xss\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"AJAX and CSRF","url":"http:\/\/ma.tt\/2005\/08\/ajax-and-xss\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/ma.tt\/2005\/08\/ajax-and-xss\/"},"thumbnailUrl":"","image":{"@type":"ImageObject","url":""},"articleSection":"WordPress","author":[{"@type":"Person","name":"Matt"}],"creator":["Matt"],"publisher":{"@type":"Organization","name":"Matt Mullenweg","logo":"http:\/\/ma.tt\/files\/2021\/05\/Photo-on-2020-10-28-at-2.05-PM-1.jpg"},"keywords":["ajax","csrf","security","web development"],"dateCreated":"2005-08-28T20:38:57Z","datePublished":"2005-08-28T20:38:57Z","dateModified":"2005-08-28T20:38:57Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"AJAX and CSRF\",\"url\":\"http:\\\/\\\/ma.tt\\\/2005\\\/08\\\/ajax-and-xss\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/ma.tt\\\/2005\\\/08\\\/ajax-and-xss\\\/\"},\"thumbnailUrl\":\"\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"\"},\"articleSection\":\"WordPress\",\"author\":[{\"@type\":\"Person\",\"name\":\"Matt\"}],\"creator\":[\"Matt\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"Matt Mullenweg\",\"logo\":\"http:\\\/\\\/ma.tt\\\/files\\\/2021\\\/05\\\/Photo-on-2020-10-28-at-2.05-PM-1.jpg\"},\"keywords\":[\"ajax\",\"csrf\",\"security\",\"web development\"],\"dateCreated\":\"2005-08-28T20:38:57Z\",\"datePublished\":\"2005-08-28T20:38:57Z\",\"dateModified\":\"2005-08-28T20:38:57Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/ma.tt\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p4oB3-BM","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":2166,"url":"https:\/\/ma.tt\/2005\/05\/usable-ajax\/","url_meta":{"origin":2342,"position":0},"title":"Usable AJAX","author":"Matt","date":"May 11, 2005","format":false,"excerpt":"Usable AJAX form.","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2254,"url":"https:\/\/ma.tt\/2005\/06\/ajax-commenting\/","url_meta":{"origin":2342,"position":1},"title":"AJAX Commenting","author":"Matt","date":"June 29, 2005","format":false,"excerpt":"This AJAX commenting looks pretty neat, has anyone made this into a WP plugin yet?","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2218,"url":"https:\/\/ma.tt\/2005\/06\/ajax-spell-checker\/","url_meta":{"origin":2342,"position":2},"title":"AJAX Spell Checker","author":"Matt","date":"June 6, 2005","format":false,"excerpt":"This AJAX spell checker seems pretty interesting and functions a lot like Gmail's. Has anyone written a plugin using it yet?","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2371,"url":"https:\/\/ma.tt\/2005\/09\/zimbra-groupware\/","url_meta":{"origin":2342,"position":3},"title":"Zimbra Groupware","author":"Matt","date":"September 21, 2005","format":false,"excerpt":"Zimbra looks like a really nice AJAX Outlook replacement.","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2237,"url":"https:\/\/ma.tt\/2005\/06\/rico\/","url_meta":{"origin":2342,"position":4},"title":"Rico","author":"Matt","date":"June 13, 2005","format":false,"excerpt":"Rico is another open source AJAX library whihc has some nice demos. Hat tip: Jeff Veen.","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2685,"url":"https:\/\/ma.tt\/2006\/08\/baychi-speaking-reminder\/","url_meta":{"origin":2342,"position":5},"title":"BayCHI Speaking Reminder","author":"Matt","date":"August 8, 2006","format":false,"excerpt":"Just a reminder, I'm speaking on \"The First 100k Users...\" at BayCHI tonight. Hope to see some of my peninsula peeps. Update: Just got back, the auditorium was packed and the audience was great --- full of energy. Bill Scott's presentation on Designing for AJAX was really fun.","rel":"","context":"In &quot;Asides&quot;","block_context":{"text":"Asides","link":"https:\/\/ma.tt\/category\/asides\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/posts\/2342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/comments?post=2342"}],"version-history":[{"count":0,"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/posts\/2342\/revisions"}],"wp:attachment":[{"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/media?parent=2342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/categories?post=2342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ma.tt\/wp-json\/wp\/v2\/tags?post=2342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}