PHP - Only allow access via AJAX

Question

In my CMS, I have a page which loads lots of mini-interfaces into a panel using AJAX. Those interfaces come from various PHP files in a /ajax directory.

Would it be possible somehow to only allow access to those files using ajax, and not just by browsing to them?

My concern is, of course, that someone finds out about the /ajax directory, and gets access to the core functionality of the CMS without even having to login. Of course I could import my user class and authenticate each of the AJAX files individually, but would it be possible to only allow access through AJAX?

No, you must put your authentication code into every request which processes server-side code. — Flukey
– Flukey, Commented Dec 7, 2011 at 19:27
@NullUserException I didn't say this was my security model in any production code - I was just curious... — Alex Coplan
– Alex Coplan, Commented Dec 7, 2011 at 19:31

Quentin · Accepted Answer · 2011-12-07 19:27:50Z

5

Would it be possible somehow to only allow access to those files using ajax, and not just by browsing to them?

No.

You could add extra HTTP headers, or modify existing ones (such as Accept) when you make the request from JavaScript … but since you are trying to do this for security reasons, that would be insufficient.

Of course I could import my user class and authenticate each of the AJAX files individually

Do that. Ajax requests are not special. They are just HTTP requests. End points created for Ajax should be secured with authentication/authorization just like any other HTTP request end point.

answered Dec 7, 2011 at 19:27

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Alex Coplan Over a year ago

thanks - will the PHP $_SESSION variable be exactly the same when accessed through AJAX?

candlejack Over a year ago

What about WebSockets?

Quentin Over a year ago

@alessadro - What about them? This question has nothing to do with websockets.

user1086374 · Accepted Answer · 2011-12-07 19:26:39Z

5

No. A hacker could just fake Ajax requests, anyway. You need to authenticate everywhere or you'll get screwed.

answered Dec 7, 2011 at 19:26

user1086374

511 bronze badge

Comments

Pointy · Accepted Answer · 2011-12-07 19:26:50Z

2

From outside a browser, it's possible for anybody to initiate HTTP requests to any public URL on your site. There's nothing special about AJAX requests other than headers, and those can be spoofed easily.

Now what can't be easily spoofed is a secure session mechanism. If you're requiring people to log in, then you should be doing that anyway.

answered Dec 7, 2011 at 19:26

Pointy

415k62 gold badges600 silver badges631 bronze badges

Comments

Mike · Accepted Answer · 2011-12-07 19:27:24Z

1

Simple answer, "no".

Your ajax files should also validate the user is logged in the same way as the front end of your system does.

answered Dec 7, 2011 at 19:27

Mike

24.5k14 gold badges84 silver badges93 bronze badges

Comments

Aurimas Ličkus · Accepted Answer · 2011-12-07 19:28:00Z

1

AJAX is almost same request as Standart request you can check header but this is not secure way. So short you can't do this. Authetificate on server side what you have proposed.

answered Dec 7, 2011 at 19:28

Aurimas Ličkus

10.1k4 gold badges26 silver badges26 bronze badges

Comments

Martin Bean · Accepted Answer · 2011-12-07 19:33:11Z

0

Authenticate your AJAX files. If there are lots of them, create a class and extend it in each individual AJAX file.

/ajax/abstract.php:

<?php
abstract class AjaxHandler {

    public function __construct() {
        // import authentication handler
        if ($authenticated) {
            $this->display();
        }
        else {
            header('HTTP/1.1 401 Unauthorized');
            exit;
        }
    }
}

Then in each file, i.e. /ajax/get_user_profile.php:

<?php
class GetUserProfile extends AjaxHandler {

    public function display() {
        // do your routine
    }
}

answered Dec 7, 2011 at 19:33

Martin Bean

39.6k28 gold badges134 silver badges207 bronze badges

1 Comment

kinsley kajiva Over a year ago

how one use this ,im interested to know how this works ?

Aero Wang · Accepted Answer · 2015-03-19 07:41:40Z

-1

Well, an alternative option you could have is to use post method to get the content from the php, and in your php you should set a key for the post method. And then system wide remove cross origin access. :)

answered Mar 19, 2015 at 7:41

Aero Wang

9,49518 gold badges75 silver badges111 bronze badges

Collectives™ on Stack Overflow

PHP - Only allow access via AJAX

7 Answers 7

3 Comments

Comments

Comments

Comments

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

3 Comments

Comments

Comments

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related