Verifying XMLHttpRequest in php

Question

I am sending data to a PHP site using the following code:

if (window.XMLHttpRequest)
      {// code for IE7+, Firefox, Chrome, Opera, Safari
              xmlhttp= new XMLHttpRequest();
      }
      else
      {// code for IE6, IE5
          xmlhttp= new ActiveXObject("Microsoft.XMLHTTP");
      }
      xmlhttp.open("GET","addEmail.php?email="+escape(email),true);
      xmlhttp.send();
      xmlhttp.close;

Is there any way of making sure that the addEmail.php is being run through the XMLHttpRequest so people cant simply go to www.domain.com/addEmail.php?email=some@thing.com to make the php site eat their email and run a thousand requests on the page? Thanks in advance

http://stackoverflow.com/questions/1953954/detecting-ajax-in-php-and-making-sure-request-was-from-my-own-website — Eric Pigeon, Dec 18 '11 at 18:09

Sweam · Accepted Answer · 2015-07-10T11:08:37.923

21

The users is always able to access the php script directly, but you can protect is a bit more by adding this check to the php script:

if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
{
  //CODE HERE
}

Additionally, like Eugen Rieck mentioned, you could send a token.

edited Jul 10 '15 at 11:08

answered Dec 18 '11 at 18:08

Sweam

422
4
10

Thanks!, that was probably what I was looking for.. sidequestion, Why do you have the 3x = checking whether its equal to 'xmlhttprequest' ? – DrLime2k10 Dec 18 '11 at 18:17
1

=== checks if they are of the same type. It's probably sufficient to use two. – Sweam Dec 18 '11 at 18:28

score 2 · Answer 2 · answered Dec 18 '11 at 18:01

2

That is fundamentally impossible.

You need to limit the number of requests per IP address on the server.

answered Dec 18 '11 at 18:01

SLaks

868,454
176
1,908
1,964

a PHP basic implementation of this would be highly appreciated Thanks sir – Adib Aroui Sep 15 '16 at 13:10

score 0 · Answer 3 · answered Dec 18 '11 at 18:06

0

The standard way to do this, is to send some sort of (time dependent) token with the page that contains the AJAX code, then send the token together with the AJAX call. Users who directly use the AJAX URL will not know the current token value.

answered Dec 18 '11 at 18:06

Eugen Rieck

64,175
10
70
92

1

but since javascript is visible, wouldn't they extremely easily be able to reverse engineer this? – DrLime2k10 Dec 18 '11 at 18:14

Verifying XMLHttpRequest in php

3 Answers3

Linked