imperium2335 Posted November 29, 2011 Share Posted November 29, 2011 Hi, I want to secure my AJAX routines which use the POST method. I want to prevent people from posting to my method with their own program/script. I have read about making a random seed that the server knows to expect from authorized AJAX sources. What is the basic code for doing this? Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/ Share on other sites More sharing options...
freelance84 Posted November 29, 2011 Share Posted November 29, 2011 If the user is logged in, you can simply check for $_SESSION data Else you can check the check the $_SERVER variables eg HTTP_REFERER Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/#findComment-1292238 Share on other sites More sharing options...
KevinM1 Posted November 29, 2011 Share Posted November 29, 2011 Else you can check the check the $_SERVER variables eg HTTP_REFERER Not reliable, as not all user agents set it. Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/#findComment-1292241 Share on other sites More sharing options...
freelance84 Posted November 29, 2011 Share Posted November 29, 2011 oo.. i didn't know that. Thanks KevinM1 Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/#findComment-1292257 Share on other sites More sharing options...
xyph Posted November 29, 2011 Share Posted November 29, 2011 Your best bet is to use some sort of private key. This kind of screws things up for AJAX though, as those requests are actually made on the client side. Any sort of private key would be revealed. Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/#findComment-1292281 Share on other sites More sharing options...
freelance84 Posted November 29, 2011 Share Posted November 29, 2011 As $_SESSION data cannot be forged (apparently), you could start a session with a private key for every user (said key need not be unique per user) and only accept AJAX requests with said key... no need to log the user in? Link to comment https://forums.phpfreaks.com/topic/252044-securing-ajax-with-a-bespoke-key/#findComment-1292290 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.