During a keynote at AjaxWorld conference here, Crockford launched a polemic against the Web as it is exists today.
“The question is not should we fix the Web but can we,” Crockford asked the crowded conference room. “The browser was not state of the art when it was introduced. It was intended as a document presentation platform and is not intended for applications.”
Crockford argued that browsers were not designed to do all ‘all of this Ajax stuff’ and the fact that Ajax works is because people found ways to do Ajax in spite of the limitations. That said he noted that Ajax development is unnecessarily difficult today and it has a major problem.
“The number one problem with the Web is security,” Crockford declared. “The browser is not a safe programming environment. It is inherently insecure.”
“A text that is benign in one context might be dangerous in another,” Crockford said. “Discovering that is difficult.”
Crockford argued that this is not a Web 2.0 problem either. All of the issues he outlined were apparent with Netscape 2 in 1995. He said the reason we hear more about security issues related to Ajax uses on Web pages is because Ajax developers are using more scripts.
The problem with DOM (define) is that all nodes are linked to all other nodes to the network which presents an insecure model.
In terms of cookies, Crockford noted that Cookies that are misused as tokens for authority are trouble too. Why? It exposes the site to cross site forgery requests.
“If there are scripts from two or more sources the application is not secure — period,” Crockford said. “So how do you do mashups which use two or more sources? Mashups are insecure and mashups must not have access to any confidential information.