Book review: Ajax Security
Summary: PortSwigger Research's review of Ajax Security by Billy Hoffman and Bryan Sullivan praises the book's clear explanations of client-side storage mechanisms, Google Gears, and mashup applications, but identifies a surprising number of technical errors in the developer advice. The reviewer disputes the book's central claim that Ajax represents a fundamental architectural shift, arguing the vulnerabilities described are mostly old-school bugs like SQL injection and broken access controls, with JSON hijacking the notable Ajax-specific exception.
What you should know: The reviewer's core objection is that the book's argument for Ajax as uniquely dangerous rests on differences of degree, not kind - more functionality means more attack surface, which is true of any large application. A security leader weighing this book for a team should know the reviewer explicitly says it is not the source for detailed, reliable guidance on attacking or defending Ajax applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026