322 Part II: Developing an Ajax Library^
Now by itself, this particular information spill does not have much effect, but remember,
with security, it is the small problems that can add up to big trouble. So read on to see how
this data might be used by a cross site request forgery.Cross Site Request Forgery
Cross Site Request Forgery (CSRF) is a somewhat misnamed and apparently innocuous
attack. It is related to XSS and generally relies on the hacker to be able to run code of their
design in an end user’s browser injected either via an XSS vulnerability or being
inadvertently run by the user who’s been tricked to visit some evil site. Unlike XSS, in a
CSRF attack, the target is not the site where the rogue code is hosted, but some other site.
Like XSS, CSRF seems a bit abstract, so it is best to clarify with an example. Say you visit
a private site, a bank called AjaxBank that requires a login. To access your private
information, you provide credentials and are authenticated. In our example, the site uses
the standard form-cookie custom authentication and so you are issued a cookie that will be
transmitted as you view pages within the protected site. After conducting your business atFIGURE 7-12 We know you’ve been there!