Is there a vulnerability if users are allowed to call any URL from your hosted website?











up vote
0
down vote

favorite












I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.



What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?



An example Javascript function for what I am trying to do :



function sendPostRequest(url, callback)

{

    $.ajax({

        type : "POST",

        url : url,

        success: callback

    });

}


Here url is got from user input.






javascript jquery ajax







share|improve this question







New contributor




Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
























    up vote
    0
    down vote

    favorite












    I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.



    What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?



    An example Javascript function for what I am trying to do :



    function sendPostRequest(url, callback)
    
{
    
    $.ajax({
    
        type : "POST",
    
        url : url,
    
        success: callback
    
    });
    
}


    Here url is got from user input.






    javascript jquery ajax







    share|improve this question







    New contributor




    Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.






















      up vote
      0
      down vote

      favorite









      up vote
      0
      down vote

      favorite











      I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.



      What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?



      An example Javascript function for what I am trying to do :



      function sendPostRequest(url, callback)
      
{
      
    $.ajax({
      
        type : "POST",
      
        url : url,
      
        success: callback
      
    });
      
}


      Here url is got from user input.






      javascript jquery ajax







      share|improve this question







      New contributor




      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      I am developing a website in which one functionality allows users to give any URL which will be then converted into ajax request and called. This can happen through GET or POST methods but only through client side javascript. The URL will be requested from the client side only.



      What issues can arise because of this? What are some ways in which this can be seen as a vulnerability for the web application?



      An example Javascript function for what I am trying to do :



      function sendPostRequest(url, callback)
      
{
      
    $.ajax({
      
        type : "POST",
      
        url : url,
      
        success: callback
      
    });
      
}


      Here url is got from user input.






      javascript jquery ajax




      javascript jquery ajax






      share|improve this question







      New contributor




      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      share|improve this question







      New contributor




      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      share|improve this question




      share|improve this question






      New contributor




      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      asked 11 mins ago









      Perceo

      1




      1




      New contributor




      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.





      New contributor





      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






      Perceo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.



























          active

          oldest

          votes











          Your Answer





          StackExchange.ifUsing("editor", function () {
          return StackExchange.using("mathjaxEditing", function () {
          StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
          StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["\$", "\$"]]);
          });
          });
          }, "mathjax-editing");

          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "196"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });






          Perceo is a new contributor. Be nice, and check out our Code of Conduct.










          draft saved

          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcodereview.stackexchange.com%2fquestions%2f209260%2fis-there-a-vulnerability-if-users-are-allowed-to-call-any-url-from-your-hosted-w%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown






























          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes








          Perceo is a new contributor. Be nice, and check out our Code of Conduct.










          draft saved

          draft discarded


















          Perceo is a new contributor. Be nice, and check out our Code of Conduct.













          Perceo is a new contributor. Be nice, and check out our Code of Conduct.












          Perceo is a new contributor. Be nice, and check out our Code of Conduct.
















          Thanks for contributing an answer to Code Review Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid …



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          Use MathJax to format equations. MathJax reference.


          To learn more, see our tips on writing great answers.





          Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


          Please pay close attention to the following guidance:


          • Please be sure to answer the question. Provide details and share your research!

          But avoid …



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcodereview.stackexchange.com%2fquestions%2f209260%2fis-there-a-vulnerability-if-users-are-allowed-to-call-any-url-from-your-hosted-w%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          -

          Popular posts from this blog

          404 Error Contact Form 7 ajax form submitting

          Image
          0 The contact form does not work, and affects loading after one try. The chrome console shows the error message: POST http://example.com/wp-json/contact-form-7/v1/contact-forms/50/feedback 404 (Not Found) send @ jquery.js?ver=1.12.4:4 ajax @ jquery.js?ver=1.12.4:4 wpcf7.submit @ scripts.js?ver=5.0.3:346 (anonymous) @ scripts.js?ver=5.0.3:53 dispatch @ jquery.js?ver=1.12.4:3 r.handle @ jquery.js?ver=1.12.4:3 How to solve this issue? thanks in advance javascript wordpress contact-form-7 share | improve this question edited Jul 17 '18 at 5:39 Kiran Shahi 4,745 3 16 43 ...
          Read more

          How to know if a Active Directory user can login interactively

          Image
          1 I would like to know if and how is it possible to know if a AD user can login interactively (on a server) in a domain. I need to know if I can find it out using a LDAP search. Thanks. windows active-directory login user-permissions user-profile share | improve this question edited 1 hour ago yagmoth555 ♦ 11.6k 3 17 42 asked 1 hour ago Luigi Luigi 6 1 New contributor ...
          Read more

          Refactoring coordinates for Minecraft Pi buildings written in Python

          Image
          0 $begingroup$ I'm fairly new to coding and I wrote this script in Python for a house with a roof in Minecraft Pi. I've found different ways to write the coordinates to make the code base shorter, but I'm wondering if it is possible for me to refactor it any further so I don't have to list each coordinate line by line. import mcpi.minecraft as minecraft import mcpi.block as block mc = minecraft.Minecraft.create() p = mc.player.getTilePos() mc.setBlocks(p.x+1, p.y, p.z+1, #Main structure starting coordinates (DO NOT ALTER) p.x+19, p.y+4, p.z+6, #Structure size/coordinates (Alters cube size) block.STONE_BRICK) mc.setBlocks(p.x+2, p.y+1, p.z+2, #Hollowing out main structure interior p.x+18, p.y+3, p.z+5, block.AIR) mc.setBlocks(p.x, p.y...
          Read more