Question

I’ve recently setup an autocomplete on an input field with JQuery. I set its source to be a publically accessible PHP page on my server.

$(document).ready(function() {
    $("input#q").autocomplete({
        minLength: 3,
        delay: 500,
        autoFocus: true,
        source: "ac.php"
    });
});

ac.php polls a search service running on the server after sanitizing input it receives.

What I want to know is if there are any ways to force access to ac.php only via the autocomplete form? I was thinking checking referrers but that can be bypassed with tools like tamperdata.

Do I even need to worry about leaving the helper publicly accessible?

Thanks

Answer 1

It’s not possible. Any ajax request in fact is an ordinary HTTP request that can be forged.

Do I even need to worry about leaving the helper publicly accessible?

No you don’t. Treat it as any other resource (page) you have on your site.