how to secure my ajax request which comes from multiple domain?

Question

I want to accept only limit domain requests such as i want to accept all request which comes from www.abc.com and www.xyz.com all other request should be denied . I can't be use token process from server side because multiple domain using my javascript code so here we can't think about server side token and HTTP_ADDR can be manipulate from javascript. Please suggest how to validate it which is reliable?

Answer 1

XMLHttpRequest will insert an Origin header into the request which tells you the site that the request came from.

Use that to populate the Access-Control-Allow-Origin header.

(This, obviously, provides no protection against non-Ajax requests).

Answer 2

It appears that you are trying to prevent Cross Site Request Forgery (CSRF) rather than preventing actors from creating arbitrary cURL requests to your site in order to retrieve data. For this purpose, I recommend the following approach.

For "safe" methods you could check that the Origin header matches your whitelist, and if so you output the Access-Control-Allow-Origin header to match. This is an implementation of CORS.

For "unsafe" methods you could set and check a header such as X-Requested-With is present. It is harder to secure unsafe methods using Origin because old browsers do not send the header, and some new browsers do not send the header for same origin requests.

The above approach only works for AJAX, and not for normal form GET or POSTs or cross domain resource requests.