Home/ Questions/Q 522775
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T08:23:21+00:00

I use my PHP back-end to detect AJAX requests by checking for a value

  • 0

I use my PHP back-end to detect AJAX requests by checking for a value in $_SERVER['HTTP_X_REQUESTED_WITH'].

This gives me a reliable detection, making sure the request is made utilizing AJAX techniques.

How can I make sure the request came from my own domain, and not an external domain/robot?

http://www.example.com/ajax?true could allow anyone to make an AJAX call and cut the information.

I could make sessions for everyone that enters my website normally, and then allow AJAX calls.. but that can be faked too.

Does it even matter these days?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Let you Controller

    • generate access token
    • store in session for later comparison

    In your View

    • declare the access token as JS variable
    • send the token with each request

    Back in your Controller

    • validate HTTP_X_REQUESTED_WITH
    • validate token

    Check these security guidelines from OpenAjax.
    Also, read the article on codinghorror.com Annie linked.

    • 0