Does jQuery's $.ajax() function handle ASP.NET authentication correctly?

Question

I have a web app protected by ASP.NET Forms Authentication. The site uses jQuery's $.ajax() functionality to call a web service in the same app.

Browsing to the web service .asmx does cause forms authentication to kick in and I once authenticated and make a $.ajax() call to the server I also see the ASP.NET session cookie and forms auth cookie being posted back to the server in Fiddler.

So...although all appears to be well, I'd like to put my mind at rest that indeed the web service will be protected by ASP.NET forms authentication when called from any of the pages in the web app using $.ajax().

Eran Galperin · Accepted Answer · 2008-11-18 04:05:50Z

3

From the server's perspective, an ajax request is not very different from normal GET/POST request - just some extra headers added on in the request. It passes through your normal authentication routine, the same as any other request - if that was not the case, you should be much more worried about the overall security of your application as requests can be forged very easily by people who know what they are doing.

You can easily setup a test to see if a resource requiring authentication successfully blocks out unauthorized requests arriving by Ajax. That should put your mind at ease.

answered Nov 18, 2008 at 4:05

Eran Galperin

86.9k24 gold badges119 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

JoshBerke · Accepted Answer · 2008-11-18 03:55:54Z

1

As long as your checking on the server that the user is authenticated then yes you should be protected. I am using $ajax to call both PageMethods and to call an ASP.Net WCF service, and things look good.

answered Nov 18, 2008 at 3:55

JoshBerke

67.3k25 gold badges131 silver badges170 bronze badges

Comments

Tim Abell · Accepted Answer · 2011-08-05 11:17:26Z

1

It'll be protected, but watch out for what happens when your auth expires and the forms auth redirects back to the login url with a 302 FOUND response.

answered Aug 5, 2011 at 11:17

Tim Abell

12.1k9 gold badges91 silver badges114 bronze badges

Collectives™ on Stack Overflow

Does jQuery's $.ajax() function handle ASP.NET authentication correctly?

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related