Hi all,

 

I'm building an application & it has some data I need to load into it once the page has loaded, so I do this after loading using Ajax / XMLHttpRequest

originalPage.php - the user loads this
httpreqPage.php - originalPage requests information from this using XMLHttpRequest

- I only want htmlreqPage to display this data when originalPage requests it - i.e. if any other web page tried to access it, or if the user tries to access the page directly - it will display no information.

Is there a simple and safe way to do this?

My current thoughts are to generate a random password when loading originalPage - store this in a PHP Session & to send it with the address - i.e. reuqests httpreqPage.php?pass=1234

Once httpreqpage recieves a pass, it checks that it matches the PHP Session - and assuming it matches, authenticates and deletes the pass from php session.

My way just seems a little bit open winded, and it's not 100% effective - i.e. if someone opens the page with javascript disabled then they will be able to get the address and load the info as there will be a generated password & it won't have been used.


So yeah, is there something simpler that can detect it is actually a XMLHttpRequest, and the page that requested it - and not a direct load?

Thanks

I would set a request header in your ajax request

XMLHttpRequest.setRequestHeader('X-Request-From','myfile.php');

then get that value in the file you need to check the request

if(isset($_SERVER['HTTP_X_REQUEST_FROM']) && $_SERVER['HTTP_X_REQUEST_FROM'] === "myfile.php"){

//Do stuff
}

a better way tho would be generate a hash and send it in the ajax request. And store this unique hash in a database then check it in the requested file to be sure the hash matches the one in the database.

Edited March 31, 20179 yr by webdesigner93

Thanks - sounds like a plan. I'll probably use a mix of the above and my own method to make it as secure as possible.

Out of interest if I load some javascript variables via ajax - is it then possible to see these variables using inspection mode on a browser?

Not 'overly' fussed if any data is viewed as the user would have to be logged into their account anyway, but I don't want to just gIve the code away either!

Thanks - sounds like a plan. I'll probably use a mix of the above and my own method to make it as secure as possible.

 

Out of interest if I load some javascript variables via ajax - is it then possible to see these variables using inspection mode on a browser?

 

Not 'overly' fussed if any data is viewed as the user would have to be logged into their account anyway, but I don't want to just gIve the code away either!

Yes any JavaScript can be viewed when viewing the browsers source including variables I assume this is what you mean. Personally I store a unique login token in the database when a user logs in. This changes each time. So for example if say a session that contains a login token that is not in the database the session is automatically destroyed same goes for if using a cookie for the login. To generate this token I use this one line of php...

$token = strtoupper(base64_encode(bin2hex(openssl_random_pseudo_bytes(32))));

Idk how you are handling your current login system but thats one way of doing it I thought I would throw out there.

 

Here is an example from my own project I'm working on...

    /**
     * Method from the class User
     ****************************
     * User token does not exists in database
     * @return boolean
     */
    public static function Invalidated()
    {
        global $db;
        //The token
        $token = (self::isLoggedIn()) ? $db->esc($_COOKIE['php_socialtkn']) : "";
        
        //Make sure token exists in database
        $q = $db->query("SELECT `ltoken` FROM `members` WHERE `ltoken` = '{$token}'");
        
        if($q->num_rows < 1)
        {
            return true;
        }

        return false;
    }

the above method will return true in order to invalidate the users login if the token does not exists in the database otherwise it will return false. And an example of where I use the above method would be inside info_update.php which an ajax request is passed to in order for the user to update their profile info...

<?php
//Load Bootstrap
require(dirname(__FILE__) . '/includes/bootstrap.php');
//User ID
$userID = User::isLoggedIn();
//User not logged in
if(!$userID){
    echo "<p class='msg-error'>You are not logged in</p>";
    exit;
}
//Invalid token cannot update info
if(User::Invalidated())
{
       echo "<p class='msg-error'>Invalid Token Cannot Update Info!</p>";
       exit;
}
//Make sure basic info form was submitted
if(isset($_POST['save-basic-info']))
{

    //Update the info
    $info = User::saveBasicInfo($userID,$_POST);
    //Info update has failed
   if(!$info){
       echo "<p class='msg-error'>"._get_msg()."</p>";
       exit;
   }
   //Info updated
   echo "<p class='msg-success'>Your info has been updated!</p>";
   exit;
}

If you have any more questions feel free to ask or PM me on here

Edited April 2, 20179 yr by webdesigner93