javascript - Certificate pinning in Ajax calls - Stack Overflow

admin管理员组

文章数量:1401407

I believe I already know the answer to this but I wanted to see if anyone had more insight into this problem. I have done certificate pinning in Android and iOS applications to make them more secure against man in the middle attacks. I am curious, can this same thing be done on a website which executes Ajax calls? I'm thinking not as the Javascript code could be modified during transport, has anyone had any experience with this?

I believe I already know the answer to this but I wanted to see if anyone had more insight into this problem. I have done certificate pinning in Android and iOS applications to make them more secure against man in the middle attacks. I am curious, can this same thing be done on a website which executes Ajax calls? I'm thinking not as the Javascript code could be modified during transport, has anyone had any experience with this?

• javascript
• ajax
• ssl
• ssl-certificate
• man-in-the-middle

Share Improve this question Follow asked Apr 1, 2016 at 14:24 Bobbake4Bobbake4 24.9k99 gold badges6363 silver badges9898 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 6

You might be interested in this: http://caniuse./#search=HPKP . Modern browsers already have support for public key pinning.

Also great article about preventing man in the middle attacks (or them making harder to pull off - as it seems "preventing" in a security context has a relative meaning): http://blog.scottlogic./2016/02/01/man-in-the-middle.html

And if you're feeling adventurous you can go really low level with a native implementation of TLS in JavaScript: https://github./digitalbazaar/forge/blob/master/README.md

本文标签： javascriptCertificate pinning in Ajax callsStack Overflow