Question

Not too clear on how to authorize PHP AJAX calls with session_id or against any $_SESSION variables actually.

Should it be stored in the database upon login and referenced against a $_SESSION storage on each AJAX call?

I know these subjects have probably been discussed ad infinitum, but I can’t seem to find a clear answer.

Thanks in advance!

Revelation

Wow, so authorization is limited to whether or not there’s a session? Scary. Makes me wonder if that’s all that .net’s web.config’s deny=”?” is doing. Thanks all for your help!

Answer 1

The session is always there because session data is server-side. As long as they have the cookie that grants them that session, they are considered an authorized user.

In the beginning of the file being called through AJAX, just do something like this:

<?php

session_start();
if(!isset($_SESSION['id'])) {
    exit;
}

?>

Nothing will be executed beyond that point unless they have an active session.

You can prevent people from accessing your AJAX files directly too, just add this:

<?php

if(!isset($_SERVER['HTTP_X_REQUESTED_WITH']) OR ($_SERVER['HTTP_X_REQUESTED_WITH'] != 'XMLHttpRequest')) {
    exit;
}

?>

Someone could still get around that, but it’s better than nothing.