I haven't tested it, but I think that much of the risks involved with technology like AJAX could be dodged completely using a technique like FJAX (that's Flash, JavaScript and Asynchronous Xml) which encapsulates all of the XML processing, XHR calls and presentation logic within a compiled Flash SWF movie. Their is no visible flash, in the traditional sense. Flash, in FJAX, is a behind-the-scenes XML parser and xmlHTTP requester, so it dodges the whole javascript-based XHR trapping. JavaScript is only used to display the results.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1879/713#713