PCMSpace

The other day I was having a discussion on Ajax and one thing that stood out as a concern for using it was “security”. If data is available openly as XML over HTTP, it is going to be a cake walk for smart hacker. Some of the issues raised related to security threat are:

• data protection
• protecting source code
• protecting web services

My initial thoughts go this way:

Data Protection: It is not necessary to use XML for data communication. GMail does not use XML in its Ajax, but serialize “js objects” directly with some built-in security mechanism.

Source Code: I think we should never place any code in presentation layer that might impose security thread. To my knowledge, Ajax doesn’t force anything specific to be done in code. It is more about how we like to design our application’s front end to make it faster. It is in our hand to decide what in our site a security issue is and how it has to be tackled.

Protecting Web Services: AJAX, has not made any changes to the Web Services. The threads present currently, hold good with Ajax.

I am looking for more opinions and the different security threads that Ajax imposes and might hamper in making an application a rich web client .

Updated 2nd September,05

Here is another view about Ajax security

http://www.theserverside.com/news/thread.tss?thread_id=36158

I came across Isomorphic’s SmartClient when one of the client was looking for rich web client development product. At first I didn’t understand what it is all about and that really invoked lot of interest. SmartClient is basically a rich web client that provides an open DHTML/AJAX client engine, rich user interface components, and metadata-driven client-server databinding systems, for rich GUI, zero-install web applications It provides Support for various standard browsers along with proprietary and Open source application servers and databases. Its web presentation layer includes:

• Foundation components
• Event Handling
• Controls
• Forms
• Grids
• Trees
• Layout
• Data binding
• Themes/ skins

There are many demo applications as well as sample code snippets that are really useful while developing rich web client. SmartClient application can be developed in

XML: for declarative user interface and /or data definitions

JavaScript: for client side user interface logic, custom components, and procedural user interface definitions

Java or C#: for server-side integration and data/service binding

Its worth while to look at SmartClient if planning to build rich web client though it takes a while to load JavaScript client engine and might act as bottleneck for dial up users.

AJAX, the new breed of dynamic web applications is emerging pretty fast. Though AJAX is not new but has recently gained popularity due to inclusion of support for the “XMLHttpRequest” object by browsers across all the platforms. It is XMLHttpRequest Java Script object that does all the tricks.

In Ajax model, a HTML page makes asynchronous call to server to fetch data in XML format which then is used by Java Script DOM object to modify the page as per the liking. Some of the usefulness that can be seen straight away which is driving people crazy are

• Server side form validation even before the user submit the data
• Freedom from Page refresh
• Easy implementation using nothing more than the current web standards, providing vast flexibility
• Auto completion of data

If this makes us think that Ajax is the future web interface design development approach, have a look at the following drawbacks:

• Book marking a page using Ajax is a problem
• Not all the browsers support and it is not part of Java Script technology standardization
• Java script cross browser compliance issues
• And of course it does increase traffic to server

So the question arise, whether to go for AJAX or not?????

Was trying to start my blog for a pretty long time and finally I am blogging….

My blog will speak about developments in Portals and Content Management Space and I hope to keep posting my comments on regular basis.

Recently have been exploring AJAX (Asynchronous JavaScript Technology), the new breed of dynamic web applications and soon will be posting my comments.

Happy Blogging