How to know whether request has come via jQuery $.ajax()

Question

I would like to determine whether or not a request to my REST API has been made from the jQuery $.ajax() method.

Before answering this question with one of the obvious answers of adding a boolean to the data sent to the server, or by adding a header, I do not want to do this...

Obviously this can be achieved like so:

$.ajax({
    data: {
         sentViaAjax: 'true'
    }
});

However, for various reasons I would like the boolean/additional header to remain hidden from the code.

Therefore, what I would like to know is does jQuery send any other data in any particular form to the server when it makes a request?

I have tried printing out the $_REQUEST array but this does not contain anything other than my data sent. Are there any unique headers to look out for? If so, are they reliable, as in, will they always be there?

@zerkms That sounds like the sort of thing I am looking for! Can I rely on it? Is it sent in all browsers (modern browsers)? — Ben Carey, May 14 '13 at 11:05
see this:: http://stackoverflow.com/questions/4301150/how-do-i-check-if-the-request-is-made-via-ajax-with-php — Sudhir Bastakoti, May 14 '13 at 11:05
@Sudhir I have already looked at that question! It is referring to codeigniter so has nothing to do with this! — Ben Carey, May 14 '13 at 11:06
@Ben Carey: see the checked answer - it has nothing to do with CI — zerkms, May 14 '13 at 11:06
@BenCarey thats a general PHP solution , nothing to do with CI — Sudhir Bastakoti, May 14 '13 at 11:07
@BenCarey It depends on what you want. If you want to know if request was sent via ajax just to format data respectively, then yes, you can rely. If you want to be sure that third-party did not send request, no, you can't, because this header might be sent manually. — Leri, May 14 '13 at 11:09
@PLB That is exactly why I want it!! Thank you very much all of you for your input. Question answered :-D — Ben Carey, May 14 '13 at 11:10
@zerkms I have deleted my answer . if u think its copy pasted .. but in actual it was not and that could help OP .. anyways no issues — alwaysLearn, May 14 '13 at 11:13

score 6 · Accepted Answer · answered May 14 '13 at 11:05

6

jQuery sends the following header on non-cross-domain ajax requests:

X-Requested-With: XMLHttpRequest

So you could look for that header on the request.

answered May 14 '13 at 11:05

T.J. Crowder

1,031,962
187
1,923
1,875

1

@Alnitak: You should, I do. Be sure you're looking at the *request* headers, not the response headers. – T.J. Crowder May 14 '13 at 11:06
it's not in the request headers listed in the network monitor part of Chrome's devtools. I didn't yet look see what the server itself receives. – Alnitak May 14 '13 at 11:07
You da man @T.J.Crowder. Would rely on this in an application? – Ben Carey May 14 '13 at 11:07
@Ben Carey: you should not rely on any client info. In this case the presence of such header means "It's likely a request has been sent with AJAX" – zerkms May 14 '13 at 11:08
4

@BenCarey: I would try to avoid caring how the request was generated. And note that if someone wanted, they could modify jQuery not to send the header, or use `XMLHttpRequest` directly, or use a tool that isn't even part of a browser to send a completely custom request... – T.J. Crowder May 14 '13 at 11:10
@T.J.Crowder Of course they can modify the header, however, I am only bothered about ajax requests sent from my application. I basically want to print the api call result in json is request has come via AJAX, otherwise redirect... So I am pretty sure I can rely on it given that it is only my code that I am bothered about? – Ben Carey May 14 '13 at 11:12
@Ben Carey: it can be stripped by some software between your app and a client: a proxy server, an antivirus, a firewall, ... (even though it's unlikely, but still possible) – zerkms May 14 '13 at 11:13
@BenCarey: Sure, I don't see why not. But if your preference for not sending a marker is just because you have a lot of different `ajax` calls, you could use `ajaxSetup` to automatically add a marker. But yeah, I would think for the use you've outlined `X-Requested-With` should be fine. – T.J. Crowder May 14 '13 at 11:13
@zerkms Yes but that is the clients problem for having anal security... If they are going to strip headers from a request then they cannot expect websites to function correctly... – Ben Carey May 14 '13 at 11:14

How to know whether request has come via jQuery $.ajax()

1 Answers1