POST Method - AJAX

[kimoo]

Hellos all,

Got a question about the POST Method..

I got a file (test.php) were i got a textbox and a button (the button calls a js function testy)

function testy(){
xmlHttp=GetXmlHttpObject()
if (xmlHttp==null) {
 alert('Your browser does not support AJAX. Contact your system administrator.');
 return
}
var url="testx.php"
url=url+"?ach=test"
url=url+"&sav="+document.getElementById('sav').value
xmlHttp.onreadystatechange=stateChangedX
xmlHttp.open("POST",url,true)
xmlHttp.send(null)	
}

my problem is that in firebug i can see the URL when i use

xmlHttp.open("POST",url,true)

or

xmlHttp.open("GET",url,true)

How can i completely hide the URL from the user?

thanks

[PeejAvery]

If you're using AJAX, there is no URL visually shown. However, if there is a URL logging system (GET only), or the user decodes some JavaScript, the URL could easily be discovered.

Remember that most browsers will also include a console which lists all current web activity as well. If you're worried about URL security, then you simply cannot access it. If it's just for user simplicity, then the method you use is unimportant. That is unless you're sending large amounts of data in which a URL max length would be reached so you'd have to use POST.

[kimoo]

my main problem is that when i send the password even though the input type is "password" i can still see it in the console of firebug. How do you solve this?

[PeejAvery]

Hence why I mentioned that URL logging shows up in GET only. Secure data needs to be passed always with POST!

[kimoo]

Hence why I mentioned that URL logging shows up in GET only. Secure data needs to be passed always with POST!

I tried the POST method and it still shows up in the console of firebug

[PeejAvery]

That's because you're just changing the word "GET" to "POST" but not the URL nor the passed

var parameters = "p1=v1&p2=v2";
xmlHttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xmlHttp.setRequestHeader("Content-length", parameters.length);
xmlHttp.setRequestHeader("Connection", "close");
xmlHttp.send(parameters);

[PeejAvery]

[ moved thread ]

[kimoo]

thanks man.. i had wrong spellings that were messing things up