I’m starting this new blog with this little suggestion: avoid ajax logins.
Ajax it’s really cool and handy, I know, but for a login page only can be useful in very particular cases. In the rest, only helps to save time to the hackers when do brute force on your site.
How works an ajax login?
- The users fills the login form and press the submit button.
- The browser sends an asynchronous request, via POST or GET.
- The server responses if the login it’s Ok or wrong, usually with an string or Json.
- If the login it’s Ok, the server sets a cookie with the user info (usually the user id) and the Javascript redirects to the user home.
- If the login fails, shows an error messages and the process starts again.
Why avoid it?
First of all, doesn’t work on IE8, because its don’t allow to write a cookie in async request.Actually works, that issue was in the beta version.- In the most cases, if the login is ok you will redirect to other page, so the only adventage of an ajax login is save some seconds saying “login error” more fast than reloads the website.
- Is not accesible (the user must have activated javascript and they browsers need to support ajax).
- You need to develop and test more for no advantages
- Isn’t KISS ! More unnecessary complex, more problems!
