What HTTP status should action return if it expects to only be used via AJAX, but was called without proper ajax headers? I feel I should signify some error, but I can’t really find appropriate one.
I guess best would be 405 Method not allowed, but it would be weird if for example ajax GET requests returned content, and plain GET would return 405.
You can fulfill the request, but you refuse to do it since it’s not in AJAX, so I think the appropriate error is 403 – forbidden.
http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4
Anyways, I don’t think any error code will be weird if it’ll be accompanied with a clear explanation.