For a mobile e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the "checkout" process through an ajax call?

The entire site is presented by making json-formatted ajax calls to the service (which is controlled). But because it's using ajax, the calls are easily read in Javascript (or through a http proxy for the transaction). SSL certificate will be installed.

If the service only responds to the site (i.e. lockdown on the IP range) would that make it secure? Are there other considerations? Are there specific security holes to protect against in this setup?

  • 4
    What does the data representation format have to do with safety? How else would you handle a checkout event in an AJAX app other than than through an XMLHttpRequest? Is comparing IP addresses an adequate safety measure for your app in the first place? We don't know enough to tell. Feb 17, 2012 at 14:53

1 Answer 1


Ajax/JSON/XHP/XHR/$insert_stupid_neologism_here is as safe as vanilla HTTP (because it is vanilla HTTP) if and only if the site is secured with SSL and you use a token system to prevent cross site request forgeries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.