How do I prevent my users from accessing directly pages meant for ajax calls only?
Passing a key during ajax call seems like a solution, whereas access without the key will not be processed. But it is also easy to fabricate the key, no? Curse of View Source…
p/s: Using Apache as webserver.
EDIT: To answer why, I have jQuery ui-tabs in my index.php, and inside those tabs are forms with scripts, which won’t work if they’re accessed directly. Why a user would want to do that, I don’t know, I just figure I’d be more user friendly by preventing direct access to forms without validation scripts.
As others have said, Ajax request can be emulated be creating the proper headers. If you want to have a basic check to see if the request is an Ajax request you can use:
However you should never base your security on this check. It will eliminate direct accesses to the page if that is what you need.