How do I prevent tampering with AJAX process page?

Question

I am using Ajax for processing with JQUERY. The Data_string is sent to my process.php page, where it is saved.

Issue: right now anyone can directly type example.com/process.php to access my process page, or type example.com/process.php/var1=foo1&var2=foo2 to emulate a form submission. How do I prevent this from happening?

Also, in the Ajax code I specified POST. What is the difference here between POST and GET?

Answer 1

First of all submit your AJAX form via POST and on a server side make sure that request come within same domain and is called via AJAX.

I have couple of functions in my library for this task

function valid_referer()
{
    if(isset($_SERVER['HTTP_REFERER']))
        return parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST) == $_SERVER['SERVER_NAME'];
    else
        return false;
}

function is_ajax()
{
    $key = 'HTTP_X_REQUESTED_WITH';

    return isset($_SERVER[$key]) && strtolower($_SERVER[$key]) == 'xmlhttprequest';
}

You might read this post regarding difference between post and get

Answer 2

While as Jason LeBrun says it is pretty much impossible to prevent people simulating a form submission, you can at least stop the casual attempts to. Along with implementing Nazariy's suggestions (which are both easy to get round if you really want to), you could also generate some unique value on the server side (i'll call it a token), which gets inserted into the same page as your Ajax. The Ajax would would then pass this token in with your other arguments to the process.php page whereupon you can check this token is valid.

UPDATE

see this question with regards to the token

anti-CSRF token and Javascript

Answer 3

You can not prevent people from manually emulating the submission of form data on your website. You can make it arbitrarily more difficult, but you won't be able to prevent it completely.