I made a calculator. I want to prevent that people can use the ajax.php to get the results without accessing the webpage. They have to use the API for that purpose.

I suppose I can add a key (timestamp encoded with symmetrical encryption) inside the webpage. When I will call the ajax.php, I will send also the key. On the server side, I will decode the key, extract the timestamp and check if the key was not generated too long ago.

I can also generate a one time key inside the database.

Do you have better ideas?

  • 2
    What do you think is the difference between an API call and a web page access? The client? The parameters? Anything you do will simply obfuscate an otherwise legitimate HTTP call. Jun 22, 2012 at 0:25

1 Answer 1

  • You can also use the CSRF token functionality available in most of the web development framework. CSRF is stored in web page's header metadata and must be sent across for each ajax request. CSRF is assigned when a full page is rendered by the server.

    If CSRF token doesn't exist in ajax request, or if CSRF is wrong then just don't process the request. This way you make sure the user was logged in the actual interface.

  • Perform session validation of each ajax request.

You can use these within an API call too.

Still it will help to protect from some web intercept proxies or custom made html web client scripts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .