Blocking non-AJAX requests to PHP [duplicate]

Answer 1

As @Evan linked in his comment, you can detect XmlHttpRequest requests by looking for HTTP_X_REQUESTED_WITH in $_SERVER. But this value comes from a header send by the client. As with any information from the user though, this can be spoofed.

There's really no way to block non-XmlHttpRequest in a practical way. If it's really important that you block the API, you can issue a unique key to the Javascript (and store it in the session) upon a request to the main page. It is passed in the XmlHttpRequest, and when that page sees it and validates it, it gives access. But even that unique key can be scraped from the page.

Answer 2

You could just not return anything when the request doesn't have the proper GET or POST variables.

With that said, its honestly not anything to worry about as anybody who actually browses the page that you send ajax requests to is probably trying to do something malicious and them receiving what is sent via ajax doesn't gain them anything. No normal user every views source...

Answer 3

Ajax libraries add a X-Requested-With: XmlHttpRequest header in their requests, so you can test for its presence:

if (!isset($_SERVER['HTTP_X_REQUESTED_WITH']) || $_SERVER['HTTP_X_REQUESTED_WITH'] != 'XmlHttpRequest')) {
    // not an ajax request
}

However a malicious user can easily send this header too, so don't use this to protect sensitive data.

Answer 4

if (strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
     //allow access
}
else
   die("Direct access restricted");

It's cheatable though