function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
DPFrazierDPFrazier 

AJAX security?

What is SFDC's stance on AJAX security issues raised at the recent RSA Conference?

Here's the opening paragraph in a CRN article on the conference:

 "Companies are moving to AJAX-based Web applications to stay trendy and fight off competitors, but they're not heeding the security risks, a security expert said Wednesday at the RSA Conference in San Francisco."

And here's the link to the CRN article:

http://www.crn.com/nl/security/showArticle.jhtml?articleId=197004122

We are developing an AppExchange client app that uses AJAX, and don't want to get blindsided if SFDC limits support for the AJAX toolkit, or if our mutual customers don't want to adopt our app because of security concerns.

Thanks,
Dean

adamgadamg
The AJAX Toolkit uses the same public Web services API as every other language / toolkit, and as such is fully secure - my guess is that your article references apps that create private/special APIs to support their AJAX work that in turn lack security coverage.

If you are using the production AJAX Toolkit that we release with Winter 07 (its the one referenced in the doc on this site), then are fully supported and safe in your use of it.