Re: cross-domain

Thomas 'PointedEars' Lahn wrote:

Bart Van der Donck wrote:
http://www.ajax-cross-domain.com/ [...]

Nevertheless, those who have a domain of their own usually don't need your
script (as they can put .htaccess and friends), and those who don't have a
domain usually can't run your script on their server (who can't/won't afford
a domain usually can't get CGI and friends because there are just not enough
ads that would pay for it).

Access to a CGI-enabled directory is needed, yes, but not the own
domain. The script runs from/to any location that supports CGI written
in Perl.

So the latter group should be made aware that all their requests and
responses can be spied^Wlogged on, either by you (no offense meant, but a
statement of confidentiality is missing from your documentation),

I cannot view/spy/log the requests. The webserver where the script
runs, can. None of the 4284 downloads of the past years runs on my
machine (except the demo) so I cannot view or log anything.

or a man-in-the-middle because the connection is only partially encrypted
(from your server to the target host) at best.

Ajax Cross Domain can run over HTTPS or HTTP. It doesn't make a
difference. Also a combination is possible:
- caller file over HTTP and ACD.js over HTTPS
- caller file over HTTPS and ACD.js over HTTP (in this case, the
browser might give a warning, because a HTTPS page requests a HTTP
javascript file, so I would not recommend this setup)

The requested remote file can use connections over http:, https:,
ftp:, news:, gopher: and a few (theoretical) others. It uses Gisle
Aas' LWP module:
http://search.cpan.org/~gaas/libwww-perl/lib/LWP.pm#NETWORK_SUPPORT

There is also the inherent insecurity of passing sensitive data in URIs to
consider, since they end up in the local history and caches, proxy caches,
and default Web server logs.  

Very true. The issue is described at the second paragraph of chapter
'Security':
http://www.ajax-cross-domain.com/#Security

But I think the risk must not be exaggerated; it's indeed inherent for
this kind of requests as you write. It's not different with Apache
rewrite rules or proxies; they can all be eavesdropped as well.

IMHO the first paragraph about security ("Calling ACD.js is only
allowed with certain query-strings") is more important.

Not to mention the limitation of data to be transmitted because browsers
(and particularly that of the browser with still the greatest market
share, like it or not); BTW, that limit is at 2083 characters per URI in
IE, not 2048.

Yes, 2048 is the path size, not the full URL. It has been corrected.

Given these facts, I have to question the overall usefulness of your
script/service, even if your intentions may be good.

Google Analytics shows between 50-100 unique visitors per day, with
10-15 daily downloads of the script. I think that remote requests from
js reflect a real need from programmers.

Thanks for the feedback.

--
Bart
.

Relevant Pages

  • Re: HTTPSConnection script fails, but only on some servers (long)
    ... (HTTP/CONNECT + switch to HTTPS) ... wget and my python script. ... >>The python script works with server A, ... the problem seems to depend on both the client ...
    (comp.lang.python)
  • Re: [Full-disclosure] Arbitrary DDoS PoC
    ... make multiple requests for just one of your requests, ... its resources to flood the targets resources. ... Not trying to really argue your examples, I'm just saying his script and ... intensive script/page on that server. ...
    (Full-Disclosure)
  • Re: How resource-intensive are these?
    ... > stringing together 8 smaller images. ... > month, because another little script of mine, BattleFishies ... > everything will come crashing down, with smoke coming out of the server ... requests in 1 second for example. ...
    (alt.php)
  • Re: PHP in html
    ... additional calls to the server, ... 20 requests are 20 requests, ... configuration of the webserver and the PHP interpreter. ... So you want to tell me that a simple page-generating script wastes more ...
    (comp.lang.php)
  • Re: Steve Carroll: 116 hits in 3 days is a bit excessive
    ... I vaguely recall noticing a similar script / spider run hitting my ... But it's a crappy script as far as flooding goes - most requests ... that is set to download an entire web page. ... are HEAD requests, that doesn't stress the server at all, really. ...
    (comp.sys.mac.advocacy)