I made a calculator. I want to prevent that people can use the ajax.php to get the results without accessing the webpage. They have to use the API for that purpose.

I suppose I can add a key (timestamp encoded with symmetrical encryption) inside the webpage. When I will call the ajax.php, I will send also the key. On the server side, I will decode the key, extract the timestamp and check if the key was not generated too long ago.

I can also generate a one time key inside the database.

Do you have better ideas?

  • 2
    What do you think is the difference between an API call and a web page access? The client? The parameters? Anything you do will simply obfuscate an otherwise legitimate HTTP call. – logicalscope Jun 22 '12 at 0:25
  • You can also use the CSRF token functionality available in most of the web development framework. CSRF is stored in web page's header metadata and must be sent across for each ajax request. CSRF is assigned when a full page is rendered by the server.

    If CSRF token doesn't exist in ajax request, or if CSRF is wrong then just don't process the request. This way you make sure the user was logged in the actual interface.

  • Perform session validation of each ajax request.

You can use these within an API call too.

Still it will help to protect from some web intercept proxies or custom made html web client scripts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.