A security advisory (PDF) issued by Fortify Software reveals that the vast majority of popular AJAX toolkits have no built-in security mechanisms to protect against JSON-based cross-site request ...

A bit more snooping around uncovered that the AJAX eval () preview script wasn’t secured by a CSRF token which could easily be exploited by a malicious hacker.

To secure AJAX requests and responses, developers should use techniques such as setting appropriate HTTP headers, using CSRF tokens and implementing authentication mechanisms.