is ajax request

[Destramic]

hey guys im tring to look for a good way of finding out if a ajax request is being performed on my page...now ive had a look about and found these two snippets.

 

Both seems to work fine...any suggestions on what one is best to use or even if there is a better way to do this would be helpful...thank you

if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) &&
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === "xmlhttprequest")
{
// is ajax 
}

if (strpos($_SERVER['HTTP_ACCEPT'], 'application/json') !== false){
// is ajax
}

[kicken]

Checking for HTTP_X_REQUESTED_WITH being set to xmlhttprequest is pretty standard. Most ajax libraries set this header for you for this reason.

[Jacques1]

The first approach is nonsense. Whether or not the request was triggered by the XMLHTTPRequest interface is completely irrelevant. Will you send a different response or refuse to respond if you somehow find out that the client actually used a different technique? Will you rename the flag when there's some new client API? Why should you? It's always the same HTTP request, and it's always the same JSON data. The (supposed) origin of the request is as unimportant as the user's hair color or their sexual preferences.

 

The point is that the client asks for a JSON representation of the resource. And that's exactly what the second approach expresses: It tells the server to deliver JSON (rather than HTML, XML or whatever). This actually makes sense.

 

Of course both approaches technically work. You might as well use a X_I_LIKE_TURTLES header, the webserver doesn't give a damn. But if you want your application to make sense now and in the future, only the second solution is valid.

[Destramic]

well my approach was to stop people accessing the page the json data is on unless it is a actual json request...was gonna put a script also which ensures the data is only gathered from my domain so its not local

[requinix]

well my approach was to stop people accessing the page the json data is on unless it is a actual json request

Any particular reason for that?

 

...was gonna put a script also which ensures the data is only gathered from my domain so its not local

Not really possible: the only thing available to you is the HTTP_REFERER and that can be spoofed very easily.

[Jacques1]

Destramic, maybe you should tell us what problem you want to solve rather than ask us about the techniques you think solve the problem.

 

What you're saying doesn't make a lot of sense.

Edited December 20, 2014 by Jacques1