Security Software Conflicts with AJAX?

ithyus needs help with the following: "My employer is running an e-commerce site that, until recently, our customers were quite happy to use. With increased traffic to the site we decided to implement AJAX to try to reduce the load on our database servers. In doing so, our customers have experienced all kinds of problems with security/privacy software such as Norton and McAfee. It seems that no matter what we do we can't make these programs happy. Bigger companies such as Google have documented work arounds for some of them, but we wouldn't be able to keep our docs current with all the software that's presently out there. I'd really like to know how Slashdot's readers have handled these issues. Since security programs don't appear to be compatible with the emerging features of the Internet, do you simply suggest that the customer disable the offending software or do you opt to offer some support for the more popular ones? Are those really the only two options? How do you justify your method?"

Generally, you work around the user's environment

[Metasquares]

In general, you want to work around users' environments, not the other way around. That means if something you're using isn't compatible with a large number of your visitors' systems, you either work around it or use something else. Then your justification becomes "because it works". If you tell everyone to uninstall their antivirus software to use your site, I suspect you'll lose a substantial number of visitors.

If you're resorting to using AJAX only ameliorate your DB load, you may wish to try more conservative methods that will work on all client machines, such as optimizing your queries, first.

Haven't run across this yet

[spyrral]

And as a web developer that tries to make good use of ajax style techniques, this is very troubling.

I'm always seeing articles about AJAX security issues, and they always puzzle me. AJAX is just another way of sending http requests to the server from the browser. If you're able to write secure server side scripts already, then you should have no trouble writing ajax responders. How do these security aps decide that these particular http requests from the browser are "bad"?