Is there a vulnerability if users are allowed to call any URL from your hosted website? [closed]
up vote
-3
down vote
favorite
I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.
What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?
An example Javascript function for what I am trying to do :
function sendPostRequest(url, callback)
{
$.ajax({
type : "POST",
url : url,
success: callback
});
}
Here url is got from user input.
javascript jquery ajax
asked Dec 8 at 6:58
Perceo
1
closed as off-topic by 200_success, Sᴀᴍ Onᴇᴌᴀ, vnp, Graipher, Mast Dec 10 at 8:41
This question appears to be off-topic. The users who voted to close gave these specific reasons:
- "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – 200_success, Sᴀᴍ Onᴇᴌᴀ, Mast
- "Code not implemented or not working as intended: Code Review is a community where programmers peer-review your working code to address issues such as security, maintainability, performance, and scalability. We require that the code be working correctly, to the best of the author's knowledge, before proceeding with a review." – vnp, Graipher
If this question can be reworded to fit the rules in the help center, please edit the question.
add a comment |
up vote
-3
down vote
favorite
I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.
What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?
An example Javascript function for what I am trying to do :
function sendPostRequest(url, callback)
{
$.ajax({
type : "POST",
url : url,
success: callback
});
}
Here url is got from user input.
javascript jquery ajax
asked Dec 8 at 6:58
Perceo
1
closed as off-topic by 200_success, Sᴀᴍ Onᴇᴌᴀ, vnp, Graipher, Mast Dec 10 at 8:41
This question appears to be off-topic. The users who voted to close gave these specific reasons:
- "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – 200_success, Sᴀᴍ Onᴇᴌᴀ, Mast
- "Code not implemented or not working as intended: Code Review is a community where programmers peer-review your working code to address issues such as security, maintainability, performance, and scalability. We require that the code be working correctly, to the best of the author's knowledge, before proceeding with a review." – vnp, Graipher
If this question can be reworded to fit the rules in the help center, please edit the question.
2
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58
add a comment |
up vote
-3
down vote
favorite
up vote
-3
down vote
favorite
I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.
What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?
An example Javascript function for what I am trying to do :
function sendPostRequest(url, callback)
{
$.ajax({
type : "POST",
url : url,
success: callback
});
}
Here url is got from user input.
javascript jquery ajax
asked Dec 8 at 6:58
Perceo
1
I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.
What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?
An example Javascript function for what I am trying to do :
function sendPostRequest(url, callback)
{
$.ajax({
type : "POST",
url : url,
success: callback
});
}
Here url is got from user input.
javascript jquery ajax
javascript jquery ajax
asked Dec 8 at 6:58
Perceo
1
asked Dec 8 at 6:58
Perceo
1
asked Dec 8 at 6:58
Perceo
1
asked Dec 8 at 6:58
Perceo
1
asked Dec 8 at 6:58
Perceo
1
1
closed as off-topic by 200_success, Sᴀᴍ Onᴇᴌᴀ, vnp, Graipher, Mast Dec 10 at 8:41
This question appears to be off-topic. The users who voted to close gave these specific reasons:
- "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – 200_success, Sᴀᴍ Onᴇᴌᴀ, Mast
- "Code not implemented or not working as intended: Code Review is a community where programmers peer-review your working code to address issues such as security, maintainability, performance, and scalability. We require that the code be working correctly, to the best of the author's knowledge, before proceeding with a review." – vnp, Graipher
If this question can be reworded to fit the rules in the help center, please edit the question.
closed as off-topic by 200_success, Sᴀᴍ Onᴇᴌᴀ, vnp, Graipher, Mast Dec 10 at 8:41
This question appears to be off-topic. The users who voted to close gave these specific reasons:
- "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – 200_success, Sᴀᴍ Onᴇᴌᴀ, Mast
- "Code not implemented or not working as intended: Code Review is a community where programmers peer-review your working code to address issues such as security, maintainability, performance, and scalability. We require that the code be working correctly, to the best of the author's knowledge, before proceeding with a review." – vnp, Graipher
If this question can be reworded to fit the rules in the help center, please edit the question.
2
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58
add a comment |
2
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58
2
2
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
2
I have voted to close this question as off-topic because you have not shown the code with enough context for us to review it properly. (Describing your code is not the same as showing us to code to review.)
– 200_success
Dec 8 at 7:58