How to secure ajax call (JS to PHP)

Question

my question is simple, but I can't find any updated informations about it.

Basically, I've a phonegap application :

HTML files
JS files
..

And php files on OVH server.

When the application need to CRUD the database (mysql-ovh), it's been done with ajax call.

For example :

if(confirm("Delete record ?")){
    params = { 
        "action": "delete_record",
        "record_id": record_id
    }
    ajax_post(params, function(data){
        if(data.status == 'success') {
            alert(data.msg);
            $.mobile.changePage( "aRandomPage.html");
        } else {
            alert("erreur : " + data.msg);
        }
    });
}

NB : ajax_post is just a personalized function doing a simple ajax post so I don't have to write all informations such as file URL and so on.

The problem is that ANYONE could edit the javascript file (Either by unzipping the .apk, .xap or by console if it is a web version) and transform the params to

params = { 
    "action": "delete_record",
    "record_id": 5
}

and delete the record number 5 (which is not his and he shouldn't be able to) or whatever record he wants, and doing so, he could delete all records.

Is there a classic way to handle this I'm not aware of ?

I came up with a solution : I could store the password in the storage.setItem(""), and everytime there is an access to the database through ajax, I would pass the userid (already stored in storage) and the password. Then I would check on PHP side if password and ID are matching (Kind of a loggin thing).

That way, I would be sure the user sending the request is the owner of the record and can delete it. (I don't see how someone could bypass that since it would require the password of the user)

Downside is to store password on client, not sure it's any better..

Thanks in advance,

Barmar · Accepted Answer · 2015-08-18 20:24:26Z

1

You need to require the user to login first. When they login, a session variable can be set in PHP with the user ID. Then when the delete_record request is made, you check whether the user ID has permission to delete that record.

answered Aug 18, 2015 at 20:24

Barmar

789k57 gold badges555 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

BelgianR Over a year ago

Can you use/maintain php session with phonegap which doesn't allow php files ?

Barmar Over a year ago

Your question says PHP files on OVH server.

BelgianR Over a year ago

PHP files are only used through ajax call from phonegap app (only html/js files)

Barmar Over a year ago

That's what I'm talking about. You should perform an AJAX call to log the user in, and it will set a session variable.

BelgianR Over a year ago

Ok, I see, I got confused between the phonegap "session" (that I am creating with storage) and the PHP session (that I wasn't aware it could maintain a session with only ajax call). Thank you very much :-)

|

Collectives™ on Stack Overflow

How to secure ajax call (JS to PHP)

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related