AJAX Security Considerations…

As many of my blog readers know AJAX is a very popular web development technology right now. AJAX offers web developers the ability to provide desktop application like functionality in web applications. Without AJAX many of the tools I use every day such as GMail, Google Reader, and Google Maps just wouldn’t be near as fun or easy to use. Don’t worry, I do occasionally use non-Google sites that make heavy use of AJAX, I just can’t think of them right now.

However, as recently reported by security researches from SPI Dynamics at the Blackhat USA 2007 security conference, the benefits of AJAX don’t come without significant security risks.

One of the main problems with AJAX is that a lot of traditional server side code is now executed on the client side. This provides would be hackers with a ton of insight on how your application functions. Once equipped with these details it is much easier for hackers to trick web applications into doing things they’re not designed to do.

The presenters at Blackhat showed the audience how a mock AJAX travel site could be tricked into selling tickets cheaper and also tricked into blocking ticket sales for the same airplane. I think these two examples show exactly how important it is for web developers to secure AJAX.

My recommendation on this subject is to not stop developing with AJAX but to take the time and effort to learn about the security problems associated with this web development technique and the ways to avoid the common pitfalls–doing so will make the web a safer place for each of us.

Just so you know where to start more about AJAX security, Darknet offers some good insight on securing AJAX by explaining some of the common ways to attack AJAX applications.

[via Ars Technica]

Sabbath Eve

I came across a wonderful prayer the other day titled A Sabbath-Eve Gospel Prayer. This is a prayer that each Christian should pray before heading off to Church. It hints on preparing your heart and mind to focus on God rather than yourself or others. My favorite part of the prayer is when the author quotes John Stott’s words:

The essence of sin is man substituting himself for God, while the essence of salvation is God substituting himself for man. Man asserts himself against God and puts himself where only God deserves to be; God sacrifices himself for man and puts himself where only man deserves to be.

These words really touch of the beauty of the Gospel. [via Questio Coram Deo]

Google Calendar on your Site

Would you like the ablity to post your an easy to maintain Calendar on your own website? Google’s Calendar makes it easier than ever. In the past, creating Calendars on web pages was a pain. I’ve tried a few solutions and looked at a few more. The easy ones weren’t very good and the complex ones were a pain to work with. At least that was my experience.

If you like how the Calendar below looks and don’t mind managing the Calendar through Google, then the tutorial below is for you.


Before we can get started you will to sign up for a Google account if you don’t already have one. Once you have an account or if you already had one, you need to sign in or goto your Calendar.

Once you’ve signed into your Calendar, you must decide if you want to share your main calendar or create a second just for your website. I recommend creating a second one so you can keep personal events separate from events you want others to see. To create a second calendar, expand (if it isn’t already) the calendar list by clicking the arrow beside Calendar.

Select Calendar

Once expanded, click the plus sign next to My Calendars (My shared Calendar has already been created, so that’s why you see “Your Shared Calendar” in the list of Calendars in the below screen shot).

Expanded View

You will need to fill in the details of your shared calendar. The main setting we’re concerned with here is to make sure “Share with Everyone” is set to “Share all information on this calendar with everyone”.

Create Shared Calendar

When prompted with “Are you sure you want to share this calendar with everyone?
Public calendars appear in Google Calendar searches.” select “Yes.”

Public Viewable Warning

Once you’ve hit the “Create Calendar” button, your shared calendar’s title should appear in the Calendars sidebar. The next step is to click on the little down arrow next to title of the calendar you want to share and select “Calendar Settings.”

Calendar Settings

This will take you back to the Calendar details page. On this page click on the “HTML” button in the Calendar Address section. When the dialog box appears, select the “Configuration Tool” Link.

Share HTML via Configuration Tool

The configuration of the Calendar is really up to you, but one thing to watch out for is the Calendar width. Make sure it will fit in the section of your site you would like to embed it in. 480 pixels wide is just right for my site. I happened to know my site’s content section is around 500 pixels wide. Several ways exist to find the width of the area you’d like to put the calendar in. Firefox has a cool plug-in called MeasureIt. You can also check your CSS file for the content div. Or you could just do trial an error. Your choice.

Shared Calendar Viewing Options

Once you’ve got all of the settings the way you like them, hit the “Update URL” button. All that’s left is copy and pasting the generated code into your website where you’d like the Calendar to appear. Easy as that!

Copy HTML Code

I don’t imagine you’ll have any problems because I’ve attempted to make this tutorial very beginners friendly, but if you do feel free to ask questions in the comments below. You can also check out Google’s brief explanation of how to do what I explained above.

What I’ve explained is a fairly basic way to add a Google Calendar to your own site. This works great for many people who want to manage their Calendar via Google’s interface and simply display the events on a website. However, the method described above doesn’t allow you or any of your site visitors to manage the Calendar or interact with it in any way.

If you would like the ability to interact with the Calendar on your site in a way that is similar to actually logging into your Google Calendar, then you need to use the Google Calendar Data API. This requires quite a bit of programming knowledge and is beyond the scope of this tutorial. I recommend reading Google’s API documentation for help with this.