Security for GWT Applications - Google Web Toolkit | Google Groups - The Diigo Meta page

• 24 Jan 11
  

  Tony Lam

  gwt security Ajax JSON programming web google Java

  • insecure server-side session management
  • To be truly safe, you may want to always assume that strings destined for innerHTML or eval are unsafe, but at the very least you've got to Know Your Code.
  • For instance, if you're writing a custom Widget that includes a hyperlink, you might include a setURL(String) method. If you do, though, you should consider adding a test to make sure that the new URL data doesn't actually contain a "javascript:" URL. 

  • Protecting Your Application

     As a GWT user, you can help reduce XSS vulnerabilities in your code by following these guidelines:
     
    •   Carefully inspect and strip or escape any strings you assign to innerHTML using GWT code 
    •   Carefully inspect any JavaScript strings you pass to GWT's JSON parser
       
    •   Carefully inspect any strings you pass to eval or assign to innerHTML via a JSNI method 
    •   Take care in your native JSNI methods to not do anything that would expose you to attacks
       
     
     The GWT team is considering adding support for standard string inspection to the GWT library.  You would use this to validate any untrusted string to determine if it contains unsafe data (such as a <script> tag.)  The idea is that you'd use this method to help you inspect any strings you need to pass to innerHTML or eval.  However, this functionality is only being considered right now, so for the time being it's still important to do your own inspections. Be sure to follow the guidelines above -- and be sure to be paranoid!
  • If you only intend your JSON data to be returned via an XMLHTTPRequest, wrapping the data in a block comment prevents someone from stealing it via a <script> tag.  If you are using JSON as the data format exposed by your own services and don't intend servers in other domains to use it, then there is no reason not to use this technique.  It might keep your data safe even in the event that an attacker manages to forge a cookie.

  3 more annotations...

• 03 Jan 11
  

  Reza Shojaei

  gwt Java

• 21 Dec 10
  

  andy lam

  Web Security_SSL

• 16 Dec 10
  

  Marcus Franzen

  GWT authentication login

• 24 Apr 10
  

  Esfand S

  gwt security tip javascript

• 19 Feb 09
  

  Filip Kis

  gwt security Ajax

• 07 Feb 09
  

  Mehdi Kabab

  imported GWT csrf javascript json security xss ajax google java

• 22 Jan 09
  

  Simone Pierazzini

  Arrivato a leggere al forging request

  tips programming web2.0 gwt java

• 04 Nov 08
  

  Frank Zimper

  security programming web2.0 gwt java

• 24 Jun 08
  

  Carsten Mjartan

  gwt security delicious

• 26 May 08
  

  mik rub

  General

• 07 May 08
  

  zfade3

  google security xsrf

• 18 Apr 08
  

  radiano

  gwt fears

• 02 Mar 08
  

  Adelbert G

  RIA GWT web app security JSON XSS AJAX delicious original

• 26 Feb 08
  

  Daniele Tricoli

  security ajax gwt javascript json

• 12 Feb 08
  

  Carlos Garcia

  gwt java seguridad

• 10 Feb 08
  

  danielpamich

  gwt security json

• 31 Jan 08
  

  Jason Brome

  Software Development GWT

• 29 Jan 08
  

  Mauricio Nagaoka

  Java Ajax Javascript GWT Web application Security

• 06 Jan 08
  

  singh_gurjeet

  security javascript GWT vulnerabilities deicious_import

• 02 Oct 07
  

  Gabriel Kastenbaum

  gwt security

• 27 Sep 07
  

  Sebastian Weber

  gwt security ajax javascript json google java programming framework free freeware development

• 25 Aug 07
  

  jonatha panni

  gwt

• 26 Jun 07
  

  Mike Fuller

  Security GWT

• 29 May 07
  

  Andres Almiray

  Security for GWT Applications

  ajax article javascript gwt security

• 11 May 07
  

  aminggs

  Before going into the GWT specifics, the article gives some useful background on AJAX security issues including Same-Origin Policy, Cross-Site Scripting, Cross-Site Request Forging, and JSON.

  document article gwt infosec ajax javascript json xss web vulnerability import:delicious

• 28 Apr 07
  

  - vlkas

  gwt

• 25 Apr 07
  

  schinni

  Java Article GWT Security

• 

  Jang Eui Jin

  ajax gwt security

• 15 Apr 07
  

  auxonne auxonne

  This article is a primer on JavaScript attacks, intended for GWT developers. The first portion describes the major classes of attacks against JavaScript in general terms that are applicable to any AJAX framework.

  ajax article code development gwt javascript security web

• 09 Apr 07
  

  guillehorno

  security gwt javascript

• 08 Apr 07
  

  rick rick

  security ajax javascript gwt

• 05 Apr 07
  

  Shane Kim

  security AJAX google JSON

• 

  Marco Martins Costa

  security javascript ajax GWT google JSON java

• 

  Joel Liu

  google security webdev

  • It is a sad truth that JavaScript applications are easily left vulnerable to several types of security exploits, if developers are unwary.  Because the Google Web Toolkit (GWT) produces JavaScript code, we GWT developers are no less vulnerable to JavaScript attacks than anyone else.  However, because the goal of GWT is to allow developers to focus on their users' needs instead of JavaScript and browser quirks, it's easy to let our guards down.  To make sure that GWT developers have a strong appreciation of the risks, we've put together this article.
• 04 Apr 07
  

  jcassain

  security

• 

  alfmor

  AJAX programming javascript webdev framework free freeware google security fromdelicious

• 03 Apr 07
  

  Foo Foo

  security ajax GWT javascript google json Java

• 

  rekadau

  SECURITY Javascript google json java ajax webdev Delicious

• 

  Steve Radman

  json security

• 

  Chrys R

  security ajax google json javascript

• 02 Apr 07
  

  bkmrkr

  read

Would you like to comment?

Join Diigo for a free account, or sign in if you are already a member.