javascript - Security jQuery Mobile + Phonegap - Stack Overflow

admin管理员组

文章数量:1410730

I'm new in development Html 5 for smartphones and tablets and am currently on a project Html 5, CSS, jQuery Mobile and PhoneGap.

The application performs munication with the server via SOAP Web Service performed via XMLHttpRequest. And how am newbie wanted to know what the concerns that I have to take issue of security in the application if I have to resort to plugins, data encryption etc., all I need to use for security.

Validation username and password'm not using form. Do not pass parameters between pages. I'm not using php. I do not know if it works to circumvent the visibility of the code because I am developing for Android and iOS.

For my inexperience provisionally'm using global variables in. Js to save the username and password for access to other methods of web sevice. Please request help on this security issue because I do not know where to start, continue and finish.

Thanks!

I'm new in development Html 5 for smartphones and tablets and am currently on a project Html 5, CSS, jQuery Mobile and PhoneGap.

The application performs munication with the server via SOAP Web Service performed via XMLHttpRequest. And how am newbie wanted to know what the concerns that I have to take issue of security in the application if I have to resort to plugins, data encryption etc., all I need to use for security.

Validation username and password'm not using form. Do not pass parameters between pages. I'm not using php. I do not know if it works to circumvent the visibility of the code because I am developing for Android and iOS.

For my inexperience provisionally'm using global variables in. Js to save the username and password for access to other methods of web sevice. Please request help on this security issue because I do not know where to start, continue and finish.

Thanks!

• javascript
• html
• security
• cordova
• jquery-mobile

Share Follow asked Dec 14, 2012 at 19:26 VictorVictor 1331010 bronze badges 1

• link about securing soap - msdn.microsoft./en-us/library/aa480522.aspx – nycynik Commented Dec 14, 2012 at 19:53

Add a ment  | 

4 Answers 4

Sorted by: Reset to default 3

There is a very detailed breakdown of PhoneGap & security available at: https://github./phonegap/phonegap/wiki/Platform-Security

In a nutshell, if you are concerned about "over the air" transmission of data, use a server with SSL, the same way you would in a web application. If you are concerned about device encryption, it is delegated to the default security mechanisms of the operating system.

Your particular stack of technology is no different than any other web application. You are still going to be vulnerable to a large number of vulnerabilities.

From the sounds of it, you're only concerned about the client side vulnerabilities that you should take into account. If this is the case, there are a number of things you should take into account.

1. If you're using HTML5, ensure it any local API's that you are using are protected. OWASP has a good list of best practices to follow https://www.owasp/index.php/HTML5_Security_Cheat_Sheet only some of these may be applicable to your specific application.
2. Any type of defense that you are going to implement for XSRF, or CSS (Cross-Site Scripting or XSS) will be in vain. The only type of defenses that will work across the board are ones that are implemented on the server side of the application (PHP, in this example).
3. Also, if you want the data to be encrypted in transit by SSL, this must be handled by the server (the SOAP web service endpoint). If this can't be acplished, then a more plicated alternative would be to use WS-Security (http://en.wikipedia/wiki/WS-Security)

Same security and considerations as webapps and NEVER use private keys from apis like parse,stackmob, google or bing maps in your phonegap projects.

In addition to following up with other ments... I would suggest the use of HTTPS/SSL + OAUTH (or some other token based mechanism) over passing the username/password with each request... though simple HTTP Authentication works.

本文标签： javascriptSecurity jQuery MobilePhonegapStack Overflow