AJAX (Asynchronous JavaScript and XML) applications are constantly looking for ways to increase their performance. One obvious way to do this is to store more data locally, since data can be loaded from a local file much more quickly than it can be retrieved from a remote website. Imagine an AJAX application pushing down database tables to your browser once and then allowing you to query that data over and over again without going back to the server.

This also would work well for applications that allow users to access some functions and data offline, queuing up and saving data until the user can reconnect to the server.

In the past, the data storage solution has been to store data in a cookie, but cookies are limited in size to 4KB per domain. Thus, cookies have generally been used to save small bits of information such as a session ID or perhaps a user’s login name for their next visit. Common HTTP cookies can be viewed with a local HTTP proxy and are sent from the website to the web browser and back. There are well-known attack vectors in cookie data–from information leakage to session hijacking to command injection, and more.

Recently, programmers have discovered two technologies that allow for storage greater than the previous 4 KB limits for AJAX applications: Adobe® Macromedia Flash and Internet Explorer’s persistence of user data. Using Adobe® Macromedia Flash, an application can save up to 100 KB without user interaction and an unlimited amount, with user agreement.

The Dojo AJAX framework already includes features for using this storage container. It is estimated that 95 percent of web browsers have Flash 6.0 or later installed—which is necessary for this feature to work properly. Another storage technology is Microsoft® Internet Explorer’s persistence of user data.

Applications using this feature can store up to 64 KB per page as an XML file outside of the standard web browser cache.

In this paper, we will explore the use of both of these solutions and explain some of the security implications associated with each solution.

You can download the whole whitepaper
here