Home/ Questions/Q 7415629
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T07:20:20+00:00

i am using Ajax to send JSON data over to my server for a

  • 0

i am using Ajax to send JSON data over to my server for a php script to parse.

for example this is the JSON which will be outputted:
http://myserver.com/parse.php?user=123&point=100&callback……

and the “parse.php” script will GET the points in the URL and give it to that user which the user id is stored in the user=123.

However , if a person directly use “http://myserver.com/parse.php?user=123&point=100&callback……” on their browser without letting my javascript to initiate it , they can cheat their points , which they can set to any amount they like in the URL.

So how can i protect/authenticate the JSON request??

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you’re passing the user points via an AJAX request or something similar client-side, then you simply cannot protect your application against cheating. Your user is telling the script he/she scored 100 points, how can you be sure that’s the fair number? Pass over the initial data you’re using to compute your score, like valid answers for the questions or whatever it is you’re measuring.

    If you have a login mechanism in your application, you could check for the valid credentials on the server-side when executing your script, without actually passing the user identifier via GET/POST.

    Lastly, in your method you can check for the AJAX header and the referer ($_SERVER['HTTP_X_REQUESTED_WITH'] and $_SERVER['HTTP_REFERER']) to make sure the request comes from your JS code, but this is really just a minor tweak which is easy to compromize. Also, not every browser passes the referer header (depends on privacy settings), so further problems may arise.

    • 0