Ajax requests are not open to everyone

Question

I created a webapp using CodeIgniter. There are several places where I use ajax in the application.

I want to know if there is a way to stop direct access and the request to the ajax controller and allow only legitimate ajax requests coming from the page being processed.

Thanks.

Answer 1

Yes, you can do it without problems. The CodeIgniter input class has a method called is_ajax_request (). Just check this at the start of your controller action. For instance:

function ajax_save() { if ($this->input->is_ajax_request()) { //continue on as per usual } else { show_error("No direct access allowed"); //or redirect to wherever you would like } } 

If you have controllers that are fully assigned to ajax calls, you can put this if statement in the function __construct() constructor for the controller. Remember to call parent :: __ constructor () first though!

Change As for the “outgoing from the page”, you should probably do authentication + security checks (probably through a session so that you don't get into the database) in your ajax request. Thus, a rogue user not connected to your web server should not, in any case, send an ajax request manually. Hope this answers your question.