Ajax and Mashup Security

Ajax and mashups represent two new Web application development approaches that both fit under the Web 2.0 umbrella.

Ajax

Asynchronous JavaScript + XML (Ajax) allows user interaction with Web pages to be decoupled from the Web browser's communication with the server. In particular, Ajax drives mashups, which integrate disparate content or services into a single user experience. However, Ajax and mashup technology introduce new types of threats because of their dynamic and multidomain nature. It is important to understand these threats and to avoid them by adhering to some best practices.

Mashups

A mashup is a web application that combines content from more than one source into an integrated experience. Usually, the mashup components interact with each other. In the classic example of a mashup, a Craigslist component is combined with a mapping component (e.g., Google or Yahoo maps) such that when a user clicks on a new Craigslist entry, the mapping component updates its view to show the new address.

Mashups typically allow the end user to discover and integrate third party, Ajax-powered mashup components onto the mashup's canvas. Examples in the consumer social networking space include Facebook Widgets and MySpace Widgets, which end users can discover and insert into their pages.

From a technology perspective, mashup components represent Ajax-powered "mini applications" that are assembled into an Ajax-powered mashup container application that provides a framework for the components to communicate with each other. Sometimes the mashup container application enables cross-site communications by providing proxy services to allow server-side redirection to Web servers that are associated with a given mashup component.

Here is a whitepaper from Open Ajax Alliance on Ajax and mashup security that you may wish to peruse.

Ajax and Mashup Security

"Web Application Security — How to Minimize Prevalent Risk of Attacks"

Vulnerabilities in web applications are now the largest vector of enterprise security attacks.

Stories about exploits that compromise sensitive data frequently mention culprits such as "cross-site scripting," "SQL injection," and "buffer overflow." Vulnerabilities like these fall often outside the traditional expertise of network security managers.

To help you understand how to minimize these risks, Qualys provides this guide as a primer to web application security. The guide covers:

• typical web application vulnerabilities
• comparison of options for web application vulnerability detection
• QualysGuard Web Application Scanning solution

Offered Free by: Qualys, Inc.

REQUEST NOW

Mobile Mashups: Breaking Out of the Pocket

What is a Mashup?

Mashup is a very general term for an application that incorporates realtime data and services (APIs) from 3rd party sources over the Internet. A Mashup is often very focused and task oriented.

Although the browser is the most accessible platform for developing and distributing a Mashup it is by no means the only platform, and arguably not always the most appropriate from an end-user perspective. mWorks, for example, provides a platform for creating mashups that run as an application on your mobile phone, Apple Widgets and Yahoo! Konfabulator both provide a platform for creating a mashups that run as Widgets on your desktop, and the list goes on. The important thing to remember about a Mashup is that it is an application that leverages realtime data and / or services accessed over the Internet. The delivery mechanism for the Mashup is completely independent. In fact, many mashups are available in mobile, widget, and browser versions.

The mobile browser is NOT the only platform “open” to the developer. You may be surprised to find out that you could create a mashup using SMS and Java in addition to the browser on a device.

Things are getting really interesting in the mobile development field.

Five years ago when you talked about application development you were most likely targeting web browsers, desktop computers, game platforms or very limited phone OS’s. On each of those platforms the vast majority of the input was via the user’s fingertips — text, buttons and joysticks.

Today’s devices obviously offer so much more. Touch, GPS, compasses, accelerometers, and proximity detection to name just a few previously unavailable input modes. This has made possible a raft of new types of applications.

The idea that the mobile phone should be a one-stop shop of digital services is universally shared in Asia. There's also a convergence of features among cell phones, personal digital assistants, cameras, MP3 players, and high-speed wireless networks that's turning mobile phones into all-purpose digital devices.

But the combination of disparate features into one device isn't just a top-down phenomenon pushed by carriers and manufacturers. Consumers often take the lead, playing with user-generated content in myriad ways. They can seamlessly "mash up" or combine, say, music or video from various sources and integrate applications from their personal computers and printers with their handsets.

The feature-power of mobile phones and the creative melding of content and software applications are bound to increase as 3G mobile handsets and ever-speedier wireless networks continue to be rolled out across the region.

Korean handset maker LG Electronics is also trying to export high-end multimedia mobile phones to the U.S., where the mashup fad is also entrenched, though more PC-based. LG's Fusic mobile phone delivers an array of services over Sprint's high-speed network. Subscribers can access Sprint TV and Sirius Satellite adio via the handset, buy songs, and copy tunes from one handset to another—or even transfer music collections to a car radio or personal computer.

Japan's mashup scene is more dominated by small Web 2.0 venture businesses than programming-savvy individuals. A company called DigitalStreet has come up with software filters that let mobile-phone users view Web pages that would normally only be accessible from a PC. In the past, businesses had to direct cell-phone users to special Web sites that were pared-down versions of the actual site, with few graphics, loads of text, and limited content.

The new programs aren't limited to Web browsers. For instance, a program called Fileseek lets you check out the latest YouTube videos from your cell phone. I see real potential as we move forward with the synergy and integration between mobile social media and enterprise applications. I am reminded how much Web 2.0 trends will drive mobile technology. When I originally started to design mMashups I had it in my mind to create a platform that would allow me to pull together interesting web services in a way that was intuitive and useful on any mobile device. Today, web services are now passé and terms like Ajax and Mashup are gaining in popularity; but this does not change the fundamental technology and concepts upon which mMashups was originally designed.

My research (with help from co-workers Viktor Stephen and Amit Kapur), has turned up an interesting list of services and sources of services. Amit pointed me to http://www.programmableweb.com which has an impressive list of XML APIs for creating mashups. Technorati and Feedburner also have some interesting APIs for navigating and browsing blogs and feeds. Sites like Flickr and TextAmerica have some interesting API’s for accessing a wealth of image content, and Google and Yahoo both have API’s for a variety of things. In addition there are some UDDI registries for for premium Web Services such as StrikeIron and XMethods.

Mobile Mashups sounds like a really interesting niche to me.

More on SEO Best Practices

Though SEO tactics evolve with the technologies used to render Web sites, certain fundamentals remain constant.

How can you tell if your site adheres to current SEO best practices? Let's start with some honest answers to the following questions:

• Are the keywords you're targeting relevant to site content?
  
  
• Are targeted keywords popular phrases used in search engine queries?
  
  
• Do page titles start with your targeted keywords?
  
  
• Does your site employ H1 header tags for prominent content titles?
  
  
• Is your permanent body copy contextually sufficient and keyword-rich?
  
  
• Do text links include targeted keywords that point users to pages within your site?
  
  
• Do you use CSS image replacement in graphical navigation on the site?
  
  
• Do graphics used in the site have descriptive, keyword-rich alternative attributes that are useful for visitors?
  
  
• Does your Web site have a site map with text links?
  
  
• Do the URLs of your dynamic, database-driven pages look simple and static?
  
  
• Does your site have a flat directory structure?
  
  
• Do your site's home page and other key category pages have PageRanks?
  
  
• Is your site listed in Open Directory?
  
  
• Do you routinely list your site in other trusted, human-reviewed online directories?
  
  
• Do all the pages in your Web site have keyword-rich meta descriptions?
  
  
• Does your site have a custom error page?
  
  
• Do the site's filenames and directory names include targeted keywords?
  
  
• Does your site avoid using pop-ups?
  
  
• Is the exact same content visible to both users and search engine spiders?
  
  
• Do you avoid free-for-all linking offers?

If you answered "yes" to all or most of the above questions, your Web site embraces some of the most common elements essential to SEO best practices. If you're unsure about some of the answers, consider the following additional information.

There's no point in angling for high rankings on keywords and keyword phrases no one searches for. If you're not certain what keywords your site's well positioned for, start digging through your referrer logs or Web analytics data to determine which search engines send your site considerable traffic for which phrases.

If you can't access your log files and search engine referral data, use a tag cloud generator to get some visual clues as to how the search engines interpret your pages. You might be surprised as to what any particular page in your site is actually optimized for.

Most subscription-based keyword analysis tools offer a free trial period. You can readily compare keyword popularity using tools such as WordTracker, KeywordDiscovery, and Yahoo's Keyword Selector Tool before deciding what phrases could send you considerable search-referred traffic.

Despite the popularity of individual words, it's best to target two- or three-word phrases on a page-by-page basis. Because of the vast number of Web pages indexed by the major search engines, competing for a listing or two on the first or second SERP for a one-word keyword is a losing battle. Trying to make one page optimal for a multitude of unrelated keyword phrases is almost equally fruitless.

It should go without saying, but the keywords you select to target should be relevant to your business and your site's content. Permanent body text should consist of at least two to three sentences on every page, ideally more. Opportunities vary from industry to industry. At the very least, try to build about 250 words into key category pages.

Of course, site structure plays a large role in how well your site's indexed. The search engines have improved their ability to crawl through dynamic URLs, yet static URL structures tend to rank better. Flash and AJAX present additional search engine visibility issues that can't be addressed in this brief column.

If you have an all-Flash site and answered "yes" to visible text links, you may want to reconsider your answer. Use the control-A function in your browser to see what words are really visible on a page, or use Zippy to take a deeper look at what any particular page or site is actually optimized for.

Better rankings come with better linking. Better linking starts within your site. Having a site map is a no-brainer, as are nongraphical site-wide navigation, footers, and related deep links.

Pursuing well-ranked inbound links is an art form and an ongoing endeavor for nearly every Web site. Just make certain you execute on the fundamentals first, which should include submissions to key directories. Once your site is listed in DMOZ, the Yahoo Search Directory, Gimpsy, JoeAnt, and the like, continually grow you inbound links with vertical directories, local listings, business partners, vendors, and so on.

Implementing the 20 most fundamental elements of SEO best practices (or at least most of them) and avoiding the dregs of worst practices should provide you with a straightforward approach to better visibility for your Web site in the major search engines.