For a mobile e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the checkout process through an ajax call?The entire site is presented by making json-formatted ajax calls to the service (which is controlled). But because it's using ajax, the calls are easily read in Javascript (or through a http proxy for the transaction). SSL certificate will be installed. If the service only responds to the site (i.e. lockdown on the IP range) would that make it secure? Are there other considerations? Are there specific security holes to protect against in this setup?
Is a JSON-based AJAX checkout safe?
ajax;e commerce;json
Ajax/JSON/XHP/XHR/$insert_stupid_neologism_here is as safe as vanilla HTTP (because it is vanilla HTTP) if and only if the site is secured with SSL and you use a token system to prevent cross site request forgeries. 