Copyright ©1997-2008 Glenn Fleishman except as noted otherwise. All rights reserved. For permission to reprint, contact Glenn Fleishman at glenn at glennf.com. Photo © 2008 Laurence Chen; used with permission.
Copyright ©1997-2008 Glenn Fleishman except as noted otherwise. All rights reserved. For permission to reprint, contact Glenn Fleishman at glenn at glennf.com. Photo © 2008 Laurence Chen; used with permission.
Turning technology from mumbo-jumbo into rich tasty gumbo
� Dun Dunn | Main | Digital Photography without a Laptop �AJAX is Asynchronous JavaScript and XML. What it lets you do is have pages that can update without reloading a page--they can pull information in from a server using JavaScript and push them into parts of a page. I'm reading a book on this now as online information about Ajax is rather scattershot, with a tutorial here and a recipe there.
The big problem I see with Ajax is that because the tasks are all performed in JavaScript, that means all authentication is revealed in the HTML page that a user can view the source of. So you can't hide anything and you can't even keep tricks from a determined user.
I have already wrestled in the past with throttling bad behavior from RSS scrapers. I currently also have a governor in place that I call "excessive host usage" which prevents any one IP address from making thousands of queries, running up my Web bills, and hurting my servers. It's been quite effective, as out of control non-major robots or other scripts tend to be very out of control, and my governor clamps them down right away.
So part of the issue with AJAX is that if I expose a server interface in which data can be queried--say the price of a given book at a given bookstore, which is what I would do with isbn.nu--I have to also make sure that that data can't be hijacked. AJAX has one great bit of a security model, which is that JavaScript won't make these queries except to the same precise domain in which the page was server. If I serve a page from isbn.nu, then I can make AJAX queries to isbn.nu. That apparently can't be easily spoofed, at least as far as I know. So that prevents someone from directly copying my AJAX code and making slight changes to reap the rewards.
Now someone could set up their own server to run the queries from my server and then pass them to their own AJAX pages. I can use a governor to prevent that. Individual users could make some number of requests over reasonable periods of time, but thousands of requests of a certain type would indicate behavior that needs to be blocked.
Posted by Glennf at September 29, 2006 4:27 PM
TrackBack URL for this entry:
https://db.isbn.nu/mt3/mt-tb.pl/4070
| Sun | Mon | Tue | Wed | Thu | Fri | Sat |
|---|---|---|---|---|---|---|
| 1 | 2 | 3 | ||||
| 4 | 5 | 6 | 7 | 8 | 9 | 10 |
| 11 | 12 | 13 | 14 | 15 | 16 | 17 |
| 18 | 19 | 20 | 21 | 22 | 23 | 24 |
| 25 | 26 | 27 | 28 | 29 | 30 | 31 |
Recent Entries
Archives
May 2008 | April 2008 | March 2008 | February 2008 | January 2008 | December 2007 | November 2007 | October 2007 | September 2007 | August 2007 | July 2007 | June 2007 | May 2007 | April 2007 | March 2007 | February 2007 | January 2007 | December 2006 | November 2006 | October 2006 | September 2006 | August 2006 | July 2006 | June 2006 | May 2006 | April 2006 | March 2006 | February 2006 | January 2006 | December 2005 | November 2005 | October 2005 | September 2005 | August 2005 | July 2005 | June 2005 | May 2005 | April 2005 | March 2005 | February 2005 | January 2005 | December 2004 | November 2004 | October 2004 | September 2004 | August 2004 | July 2004 | June 2004 | May 2004 | April 2004 | March 2004 | February 2004 | January 2004 | December 2003 | November 2003 | October 2003 | September 2003 | August 2003 | July 2003 | June 2003 | May 2003 | April 2003 | March 2003 | February 2003 | January 2003 | December 2002 | November 2002 | October 2002 | September 2002 | August 2002 | July 2002 | June 2002 | May 2002 | April 2002 | March 2002 | February 2002 | January 2002 | December 2001 | November 2001 | October 2001 |