Member Avatar for Olagsfark

I've got a simple php script here that recieves a POST data from my ajax script. But i want to make sure that only my own ajax script can have a successful request from the page and not some other ajax scripts to avoid brute attacks as ajax requests are faster and can consume website resources . Please, help on how to go about this guys. Thanks in advance

  • 3 Contributors
  • 3 Replies
  • 667 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by Olagsfark

Dani AI

Generated

Good to see solved it with a session variable and that and raised referer/CAPTCHA and token ideas. Short principle: never trust client-side evidence (headers, JS flags) alone. Browser headers like Referer/Origin or X-Requested-With help detect cross-site browser flows but can be absent (privacy/proxy) or faked by non-browser clients. Server-side proof tied to an identity/session plus throttling is the reliable defense.

A practical, compact pattern: issue a cryptographically strong nonce per session or per form, store it server-side, inject it into the page once, and require it with every AJAX call. Validate the value server-side using a constant-time comparison and expire/rotate it after use. Example pattern in PHP:

// when rendering the page
if (!isset($_SESSION['csrf'])) {
    $_SESSION['csrf'] = bin2hex(random_bytes(32)); // PHP 7+
}
echo "<script>window.csrfToken = '".$_SESSION['csrf']."';</script>";

// in the AJAX handler
$token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? $_POST['csrf'] ?? '';
if (!hash_equals($_SESSION['csrf'] ?? '', $token)) {
    http_response_code(403);
    exit;
}
unset($_SESSION['csrf']); // single-use

Complement the token with server-side measures: require an authenticated session or API key for sensitive endpoints, enforce strict Content-Type checks, configure CORS to allow only the site’s origin where appropriate, implement rate-limiting (application, nginx, or CDN/WAF), and log+alert on abnormal patterns. Use CAPTCHA only as a fallback for anonymous/suspicious flows. These layers together mitigate brute attempts far better than any single header check.

Summary: combine session-bound nonces (or signed tokens), authentication, and throttling. Treat Referer/Origin and X-Requested-With as helpful heuristics, not as definitive proof.

Recommended Answers

All 3 Replies

Member Avatar for minitauros

You could check from which website the user is referred to a page? Check out $_SERVER['HTTP_REFERER']. You can also add CAPTCHA validation to your form, which should be different for every form that is submitted. You store the correct CAPTCHA answer in a session when the form page is loaded, for example, and then validate if the answer is correct in the file in which the form data is processed.

By the way, AJAX requests are not simply always that much faster. It depends on which resources need to be loaded when you execute your AJAX file. If your base page needs to include 10 big files, and if your AJAX file needs those same files, you will have to include them again in your AJAX file, which does not necessarily speed up your application that much.

Oh and another thought: not only AJAX files are accessible through $_POST. Regular pages with a form on it can also be read; the target of a form can always be accessed.

Member Avatar for Noranterry

if you want to just get your ajax requests your php code, then you must pass token pass a variable type as well as any other variable you pass, then you should validate it on the server with php, Greetings

Member Avatar for Olagsfark

Thanks man, i've got it worked out with a session variable

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.