How safe is JSONP implementation for login functionality

Posted by MKS on Stack Overflow See other posts from Stack Overflow or by MKS
Published on 2010-12-23T07:42:05Z Indexed on 2010/12/23 7:54 UTC
Read the original article Hit count: 258

Filed under:

jquery-ajax

|

jsonp

Hi Guys,

I am using JSONP for login authentication, below is sample JQuery Code:

$.ajax({  
        type:"GET",        
        url: "https://staging/login/Login.aspx",  // Send the login info to this page
        data: str, 
        dataType: "jsonp", 
        timeout: 200000,
        jsonp:"skywardDetails",
        success: function(result)
        { 
              //Do something after the success
        } 

    });

In above code, I am having HTTPS page for authentication, from my login dailog box, I am sending username and password to my login.aspx page, which calls "WEB SERVICE" taking input send by the login dialog page and return the users details as JSONP object.

My question is that, how safe is above implementation and do also suggest how can I improve my security implementation.

Thanks!

© Stack Overflow or respective owner

Related posts about jquery-ajax

AJAX Return Problem from data sent via jQuery.ajax

as seen on Stack Overflow - Search for 'Stack Overflow'
I am trying to receive a json object back from php after sending data to the php file from the js file. All I get is undefined. Here are the contents of the php and js file. data.php <?php $action = $_GET['user']; $data = array( "first_name" = "Anthony", "last_name" = "Garand"… >>> More
what does xhr status code 408 error mean in jquery ajax

as seen on Stack Overflow - Search for 'Stack Overflow'
i am making ajax calls with jquery like this http://pastie.org/860837 and sometimes i get the ajax errors, and i get xhr status as 408. what does that mean? >>> More
jQuery Ajax call - Set variable value on success.

as seen on Stack Overflow - Search for 'Stack Overflow'
Hey all, I have an application that I am writing that modifies data on a cached object in the server. The modifications are performed through an ajax call that basically updates properties of that object. When the user is done working, I have a basic 'Save Changes' button that allows them to Save… >>> More
loading page framents with Jquery AJAX

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use $.ajax() to request a page, but load only fragments of that page. I know you can specify what page fragments you want with .load() but I was wondering if this is possible with $.ajax? >>> More
loading page framents with Jquery AJAX

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use $.ajax() to request a page, but load only fragments of that page. I know you can specify what page fragments you want with .load() but I was wondering if this is possible with $.ajax? >>> More

Related posts about jsonp

jQuery/JSONP widget and jquery version conflict

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to create a widget so that my visitors can display it on their blog/website. I would like to use jquery and jsonp to develop this widget. I know how to avoid conflicts between jQuery and other libraries (like prototype). But what will happen if jquery is already installed on my visitors'… >>> More
Why isn't jQuery automatically appending the JSONP callback?

as seen on Stack Overflow - Search for 'Stack Overflow'
The $.getJSON() documentation states: If the specified URL is on a remote server, the request is treated as JSONP instead. See the discussion of the jsonp data type in $.ajax() for more details. The $.ajax() documentation for the jsonp data type states (emphasis mine): Loads in a JSON block… >>> More
Does JSONP scale? How many JSONP requests can I send?

as seen on Stack Overflow - Search for 'Stack Overflow'
Based on Please explain JSONP, I understand that JSONP can be used to get around the same-origin policy. But in order to do that, the page must use a <script> tag. I know that pages can dynamically emit new script tags, such as with: <script type="text/javascript" language='javascript'> … >>> More
is JsonP working with Opera, Chrome & Safari ?

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, On a web site that I am building , when you log in (because the database is on an other server), I use json padding to check if the user as the right credentials. It's working flawlessly (ie7,ie8 & FF), until I tried it on chrome, safari & opera where it's a complete disaster. … >>> More
Creating a JSONP Formatter for ASP.NET Web API

as seen on West-Wind - Search for 'West-Wind'
Out of the box ASP.NET WebAPI does not include a JSONP formatter, but it's actually very easy to create a custom formatter that implements this functionality. JSONP is one way to allow Browser based JavaScript client applications to bypass cross-site scripting limitations and serve data from the non-current… >>> More