Starting to Learn Ajax

AJAX is Asynchronous JavaScript and XML. What it lets you do is have pages that can update without reloading a page--they can pull information in from a server using JavaScript and push them into parts of a page. I'm reading a book on this now as online information about Ajax is rather scattershot, with a tutorial here and a recipe there.

The big problem I see with Ajax is that because the tasks are all performed in JavaScript, that means all authentication is revealed in the HTML page that a user can view the source of. So you can't hide anything and you can't even keep tricks from a determined user.

I have already wrestled in the past with throttling bad behavior from RSS scrapers. I currently also have a governor in place that I call "excessive host usage" which prevents any one IP address from making thousands of queries, running up my Web bills, and hurting my servers. It's been quite effective, as out of control non-major robots or other scripts tend to be very out of control, and my governor clamps them down right away.

So part of the issue with AJAX is that if I expose a server interface in which data can be queried--say the price of a given book at a given bookstore, which is what I would do with have to also make sure that that data can't be hijacked. AJAX has one great bit of a security model, which is that JavaScript won't make these queries except to the same precise domain in which the page was server. If I serve a page from, then I can make AJAX queries to That apparently can't be easily spoofed, at least as far as I know. So that prevents someone from directly copying my AJAX code and making slight changes to reap the rewards.

Now someone could set up their own server to run the queries from my server and then pass them to their own AJAX pages. I can use a governor to prevent that. Individual users could make some number of requests over reasonable periods of time, but thousands of requests of a certain type would indicate behavior that needs to be blocked.