<< Home

Security issues when using javascript

It's important to remember that the main concept of the javascript programming language is to add functionality to web pages. Javascript was not designed to interact with files on the machine where you are running the web page on. If javascript was allowed to access files on users client machines then it could pose severe security issues with the following:

  1. Reading: if we allowed websites to read any file on our computer we may give away private information
  2. Writing: If we allowed websites to write to files they may plant viruses on our machines
  3. Client files: Client files are files that are stored on your machine. Allowing websites to interfere with these files could be very dangerous.
  4. Opening/closing user windows: Imagine if we allowed websites to open or close windows they could take control of our client machine
  5. Reading information: Imagine if you had you credit card details stored on your machine and allowed any website that you visited to access this information.

There are some ways to read and write to files using javascript but these are mainly used when you are running javascript on your local machine and not over the web. To do this you can run the js files on using a javascript editor stored on your local machine. This does not pose a security issue as you as a developer will know what you are doing. Here's a good article on how javascript is used to read and write client files: http://www.c-point.com/JavaScript/articles/file_access_with_JavaScript.htm

The only way to actually read and write to client files over the web is to use Active X. This can only be done in Internet Explorer and not any other web browser like: firefox, chrome, opera or netscape. The internet explorer browser will give a security warning telling the user that a script is running that may cause harm to your client machine so there is built in security.

Another good article on javascript security issues is shown here: http://www.howtocreate.co.uk/tutorials/javascript/security

For the assignment you need to show that you understand the security issues in relation to reading, writing, cliebt files, user windows and reading information.