What are the security issues with AJAX?

Answer
AJAX function calls are sent in plain text to server. These calls may easily reveal database details, variable names etc

User’s browsing session can be monitored my maliciously inserting scripts

Ajax may encourage developers to use multiple server side pages thereby introducing multiple entry points for attackers

Are there any security issues with AJAX?

• A JavaScript can not access the local file system without the user's permission.
• An AJAX interaction can only be made with the servers-side component from which the page was loaded.
• A proxy pattern could be used for AJAX interactions with external services.
• The application model should not be exposed as some user might be able to reverse engineer the application.
• HTTPS can be used to secure the connection when confidential information is being exchanged.

Describe how to handle concurrent AJAX requests.

Answer
JavaScipt closures can be used for handling concurrent requests. A function can be written to handle such requests. Once processing of code is over, URL and the call back function to call can be passed as parameters. These parameters are passed to the AJAXInteraction(url, callback) object. Closures insure that the proper callback function associated with a specific AJAX interaction is called.

When should AJAX NOT be used?

Answer

If the page is expected to be shown in a search engine like Google. Since Web crawlers don’t execute javascript code.

If the browser does not support JavaScript. 

If security is a big concern in the application; Since Ajax allows end user to see half of what’s being sent to the server. 

How do you know that an AJAX request has completed?

Answer
By determining the readyState property value of XMLHttpReqyest, One can know if the request is completed. If the readyState value = 4, the request has been completed and the data is available.

How do I handle the back and forward buttons?

Answer
In order to store changes in the browsers web history (enabling back and forward buttons) Iframes can be used. Iframes allow am HTML document to be embedded in another HTML document.

RSH (Really Simple History) framework can also be used. RSH framework explains the management of bookmarks and history for Ajax applications.