Securing AJAX Requests ( How to prevent ajax request from another domain )

if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {

  // Do Something

}

if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER']=="http://yourdomain/ajaxurl")
{

 //Request identified as ajax request

}

if (strpos($_SERVER['HTTP_REFERER'], 'yourdomain.com')) {

   // check Request from same origin

}

/*
* in case of form post.
*/

if (isset($_SERVER['HTTP_ORIGIN']) && $_SERVER['HTTP_ORIGIN'] == 'http://www.yourdomain.club') {
 // check origin
}

No comments:

Post a Comment