I started using some simple Ajax on my website, and first thing that i saw is that you can see ajax.php file that was called by ajax function. I'm trying to secure it so if someone tries to access it directly he get's redirected to home page..
I saw that you can set a the named request header from ajax and use it on requested page. Is that enough
PHP Code:
function ajaxFunction()
{
var xmlhttp;
if (window.XMLHttpRequest)
{
// code for IE7+, Firefox, Chrome, Opera, Safari
xmlhttp=new XMLHttpRequest();
}
else if (window.ActiveXObject)
{
// code for IE6, IE5
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
else
{
alert("Your browser does not support XMLHTTP!");
}
xmlhttp.onreadystatechange=function()
{
if(xmlhttp.readyState==4)
{
document.getElementById("ajaxtest").innerHTML = xmlhttp.responseText;
}
}
xmlhttp.open("GET","ajax/msg.php",true);
xmlhttp.setRequestHeader("X_SECURE", "secure");
xmlhttp.send(null);
}
msg.php
PHP Code:
<?php
if (empty($_SERVER['HTTP_X_SECURE']) && $_SERVER['HTTP_X_SECURE'] != "secure") {
header("Location: ../");
}
else {
print "Running ajax";
}
?>
But, what if someone sends that header with curl or something similar, is it possible to "break" this script, and how to make it more secure?
Before you post, read our: 
