I'm new to web applications. I have developed a web application using ASP.net. After hearing about jquery and going through some examples, I changed the existing application and used jquery to do most of the ajax work. On the server side I used html handlers for db connections and data processing.
Because I'm using jquery, my concern is my script is visible to users of the application. Will this be a security issue? Am i following a right path?
jQuery is not a programming language. It is a JavaScript framework. Your AJAX code is not any more visible just because you switched to jQuery. No matter what, AJAX relies on JavaScript in the client, so that code is visible to whomever uses the web application. (Afterall, AJAX stands for Asynchronous Javascript And XML.)
There may certainly be security holes in jQuery. However, chances are there will be bigger holes in what you write. (This isn't meant to put you down, but you are a neophyte. Expect to make mistakes.) jQuery is used by many and programmed by a group of developers. Security is one of the things that is on everyone's minds.
I would worry more about the code I wrote with jQuery then the code that makes up jQuery. Just keep up on the updates and news about it, so that you are aware of any security issues that are identified. And, of course, learn the best practices for creating secure applications.
No. JQuery is executed in the browser, an from a security point of view, the browser is always unreliable. No matter how much JavaScript you use or which JS frameworks, it's always under control of the attacker. Security has to implemented on the server side. It's a common mistake beginners make, to place security checks in the JavaScript part and let the server trust it.
Any javascript is visible to attackers, that is just the way the web works, browser downloads the script file and then executes it. Making a request for a script file, is the exact same process as making a request for a webpage.
For example, if you are using Google Chrome right now (and for web development you should be using either google chrome or Firefox with firebug installed) hit Ctrl+Shift+J to open up the Developer TOols. You will be able to see everything about this web page. Click the Elements tab, expand the area that says <head> and look in there for any of the script elements, you will see something like this:
See those urls in the script tags? Those are the urls that you go to to get that code, you can type them directly into your browser and get those files, this is how all webpages work and the trick is to accept it and program secure code even with your hand showing.
Heck, nowadays it's not that hard to decompile and reverse engineer any application so this is generally a good idea. The only time that someone seeing your code would be a problem is if they can see that you have coded a security bug and honestly, javascript does a decent enough job of minimizing your chances for doing something stupid that if you keep learning, and don't do anything too crazy you will be just fine.
