The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

identical to what was there before. This way of operating creates a punctuated

user experience and differs greatly from the behavior of local applications such

as email clients and other office software.

Continued

Chapter 12 

■

Attacking Other Users

389

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 389

---

390

Chapter 12 

■

Attacking Other Users

AJAX (continued)

Ajax enables web developers to implement a user interface whose behavior

is much closer to that of local software. User actions may still trigger a round

trip of request and response to the server; however, the entire web page is not

reloaded each time this occurs. Rather, the request does not occur as a browser

navigation event but is made asynchronously by client-side JavaScript. The

server responds with a lightweight message containing information in XML,

JSON, or any other format, which is processed by the client-side script and used

to update the user interface accordingly. For example, in a shopping applica-

tion, clicking the Add to Basket button may simply involve communicating this