0

I am trying to create a methodology for submitting forms on my WordPress site. In the past, I have used WordPress nonces in order to secure form submission, but I like the idea of using jQuery to sanitize and act on a form submission.

My question: If I am using jQuery to submit a form (i.e. there would be no POST data and no page reload), doesn't that mean that I will not have to use nonces at all? Is there any security risk/downside to doing it this way?

Improve this question
1
  • 3
    How do you want to submit anything without sending data?
    – fuxia ♦
    Commented May 22, 2013 at 8:44

1 Answer 1

Reset to default
6

jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not.

Think of it like this, sometimes it's the user in the first frame, sometimes it's javascript:

enter image description here

Firstly nonces are not the same as sanitisation, they have different purposes

Sanitisation is about verifying what the source says is in the correct format, checking for misformatted data, and catching when malicious data is sent.

Nonces are cryptographic tokens that ensure that the user is sending the request from the correct place, with the correct permission. The user could only have gotten that security token if they were in the right place at the right time ( remember the bug when you could put an image in your content but the src attribute didnt point to an image, it pointed to a facebook logout URL? That's what nonces are there to prevent ).

So use both.

Also, client side sanitisation isn't enough. What if I turn off Javascript, or there's an error preventing the sanitisation running?

See here: https://stackoverflow.com/questions/3483514/why-is-client-side-validation-not-enough

You need PHP level sanitisaiton too, it's unavoidable. Never trust anything the client/browser sends you. It may not even be a browser or your page sending it.

Suggested topics of research:

Improve this answer
8
  • What if I am using jQuery's .ajax method to submit the form - would I still use nonce? Sorry for the n00b questions - still trying to wrap my head around security best practices -
    – William
    Commented May 22, 2013 at 15:06
  • 1
    Ask yourself, "Why would using AJAX make any difference at all to the use of nonces". The AJAX API is not magic HTTP voodoo, your browser doesn't route the address bar requests down the phone line and the AJAX requests through the water pipes, they're both the same
    – Tom J Nowell ♦
    Commented May 22, 2013 at 15:34
  • 1
    Also, how would you disable access if the user doesn't have JS? What's to stop me pretending I have JS, or injecting my own JS? You will need PHP server side validation. There is no avoiding it. The biggest thing about secure coding is not to trust a thing the client sends to the server, that's why we have nonces to verify a request came from a valid place, and data sanitisation to check what was sent was valid
    – Tom J Nowell ♦
    Commented May 22, 2013 at 15:36
  • 1
    Also, what's to stop me opening up a command line and sending raw data, bypassing all clientside restrictions? You cant detect these things if there isn't even a browser involved. A lot of browsers already have extensions to do this, and anyone with basic html knowledge could insert their own form via firebug/inspector
    – Tom J Nowell ♦
    Commented May 22, 2013 at 15:37
  • 1
    I've ammended my answer to be clearer
    – Tom J Nowell ♦
    Commented May 22, 2013 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.