Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have a PHP page (“An API”) that does server-side stuff (e.g. entering info into a database) based on GET string input.
Would it be possible for me to secure it so that only the JavaScript code on a specific site can access the api, including securing it against, for example, someone typing into a JavaScript console while on the site?
No, it is impossible to completely protect against that.
You may, however, make it more difficult. For example:
Refererheader to point to that page (some browsers don’t sendReferer, however)X-Requested-Withbeing equal toXMLHttpRequestif the JS library you’re using sets that.