C-sharp : Unsafe JavaScript framework

The application uses Ajax framework that opens access to valuable data for attackers when used incorrectly.

Microsoft AJAX.NET uses JSON for data exchange between client and server. The framework generates responses containing valid JavaScript code that can be executed within the <script> tag. This may lead to JavaScript hijacking attacks.

Although the default AJAX.NET uses POST requests, which complicates the task of creating a malicious request from the <script> tag, the framework also contains mechanisms for work with GET requests. Moreover, many sources recommend using exectly GET requests to improve performance due to browser caching.