Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I made a calculator. I want to prevent that people can use the ajax.php to get the results without accessing the webpage. They have to use the API for that purpose.

I suppose I can add a key (timestamp encoded with symmetrical encryption) inside the webpage. When I will call the ajax.php, I will send also the key. On the server side, I will decode the key, extract the timestamp and check if the key was not generated too long ago.

I can also generate a one time key inside the database.

Do you have better ideas?

share|improve this question
2  
What do you think is the difference between an API call and a web page access? The client? The parameters? Anything you do will simply obfuscate an otherwise legitimate HTTP call. –  logicalscope Jun 22 '12 at 0:25
add comment

1 Answer 1

up vote 2 down vote accepted
  • You can also use the CSRF token functionality available in most of the web development framework. CSRF is stored in web page's header metadata and must be sent across for each ajax request. CSRF is assigned when a full page is rendered by the server.

    If CSRF token doesn't exist in ajax request, or if CSRF is wrong then just don't process the request. This way you make sure the user was logged in the actual interface.

  • Perform session validation of each ajax request.

You can use these within an API call too.

Still it will help to protect from some web intercept proxies or custom made html web client scripts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.