Question

I read that checking the X-Requested-With header of the ajax request is a good way to make sure the request isn’t coming from outside. On the server side, how do I check this header? and what’s the right way to react of this header is missing or wrong (redirect, throw exception, else)?

Answer 1

You can check it like this…

$isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) AND 
          strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest';

If you are only expecting access via XHR, then just exit if this header is not present.

Note: This header is trivial to spoof. Don’t rely on this for anything but it looks like it came from na XHR.