# Ajax in rails is a security violation **URL:** \ **Category:** Rails\ **Created:** [January 4, 2006, 6:13pm UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626 "2006-01-04T18:13:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 4, 2006, 6:13pm UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/1 "2006-01-04T18:13:31Z")
Does anybody have any issues with the AJAX code inside rails? Whenever i use any sites i have built, or even external sites (such as basecamphq) my internal security device blocks access to the Ajax piece with a 400 Bad Request ( i scoured the net for other ajax examples and no isses anywhere else). I think there is something in the AJAX code of rails that is not implemented correctly. Has anybody else come across this ? thanks adam ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 4, 2006, 6:20pm UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/2 "2006-01-04T18:20:45Z")
Adam D. wrote: > Does anybody have any issues with the AJAX code inside rails? Whenever > i use any sites i have built, or even external sites (such as > basecamphq) my internal security device blocks access to the Ajax piece > with a 400 Bad Request ( i scoured the net for other ajax examples and > no isses anywhere else). I think there is something in the AJAX code of > rails that is not implemented correctly. Has anybody else come across > this ? Nope… What is this internal security device of which you speak? ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 4, 2006, 6:26pm UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/3 "2006-01-04T18:26:51Z")
On 1/4/06, Adam D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Does anybody have any issues with the AJAX code inside rails? Whenever i > use any sites i have built, or even external sites (such as basecamphq) my > internal security device blocks access to the Ajax piece with a 400 Bad > Request ( i scoured the net for other ajax examples and no isses anywhere > else). I think there is something in the AJAX code of rails that is not > implemented correctly. Has anybody else come across this ? > > thanks > adam Perhaps you could explain what the criteria your ‘internal security device’ uses to determine if a request is a bad one. AJAX requests are the same as HTTP requests for the most part. The only thing I can think of off hand are the custom header that prototype adds. But, I believe it’s a perfectly valid header extension. – rick [http://techno-weenie.net](http://techno-weenie.net) ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 5, 2006, 3:42am UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/4 "2006-01-05T03:42:52Z")
why does prototype add custom headers? Is there a way to test it without those headers? the device is a spyware/malware proxy by a company called Finjan. It seems to only block requests for Rails XMLHttp requests, and i am trying to figure out why. the unique header is definitely one of the possibilities, is there an easy way to disable this ? thanks adam ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 5, 2006, 3:51am UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/5 "2006-01-05T03:51:58Z")
On 1/4/06, Adam D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > why does prototype add custom headers? Is there a way to test it > without those headers? > > the device is a spyware/malware proxy by a company called Finjan. It > seems to only block requests for Rails XMLHttp requests, and i am > trying to figure out why. the unique header is definitely one of the > possibilities, is there an easy way to disable this ? Look at Ajax.Request.setRequestHeaders(), in prototype.js. It sends info on the version of prototype that’s being used. One major use is the fact that I can detect prototype requests in controllers and treat them differently than normal requests. Easy way to disable it? Not for other websites unfortunately. – rick [http://techno-weenie.net](http://techno-weenie.net) ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 5, 2006, 3:58am UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/6 "2006-01-05T03:58:01Z")
On 1/4/06, Adam D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > why does prototype add custom headers? Is there a way to test it > without those headers? > > the device is a spyware/malware proxy by a company called Finjan. It > seems to only block requests for Rails XMLHttp requests, and i am > trying to figure out why. the unique header is definitely one of the > possibilities, is there an easy way to disable this ? Sounds like Finjan is broken. ---
**Author:** ![adamdorsey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ed8c4c/32.png) [@adamdorsey](https://www.ruby-forum.com/u/adamdorsey)\ **Post date:** [January 5, 2006, 5:44pm UTC](https://www.ruby-forum.com/t/ajax-in-rails-is-a-security-violation/51626/7 "2006-01-05T17:44:22Z")
well i would agree that the device is broken, but every other example of an AJAX example works fine with XMLHttp request, only rails AJAX samples are broken, which is why i tried to figure out the difference. At this point it seems to be the custom headers that may be throwing it off. thanks adam