I have an XML web service that javascript calls are made using jQuery. This can output JSON or XML based on the parameters input.
Is there a way to stop someone from easily just finding the URL of the AJAX call and then loading that into a cURL script and parsing the data.
The users to the site do not authenticate but open to some creative methods! As it is AJAX is the user-agent set or can I block it using an .htaccess file in any way?
Most Ajax requests send the header
X_REQUESTED_WITH = XMLHttpRequest.So as an extra measure check for the
X_REQUESTED_WITHheaderBut this still won’t stop people finding the url’s and running them if they know what they’re doing.