Hi

I've just recently started working with AJAX and I've read some guides, AJAX schools, tips etc. But there is one thing I don't understand. How can I secure the PHP documents on my server that are being requested by AJAX?

For example, if I edit some fields and want to change some data in my Database, then a page must be requested, lets say 'updateField.php', which will recieve the new data and put it in the DB. And this service is only available for logged in members.

But what if I directly access the file 'updateField.php' in my browser? How can I check wheather or not it is a valid request from a logged in member or not? If I'm not logged in I want the file to simply run exit().

I tried to simply check if the sessions that are set at login was valid, but since those sessions only goes for the user and his browser, they're not valid for an AJAX request.


I'm confused, please help
lizciz

If I understand correctly, you want the file only readable by your JavaScript.

I would assume you could use something like this:

PHP Code:

If($HTTP_REFERER != "http://mysite.com/myjavascript.js")
{
   print "Not for your eyes!";
   exit();
} 


But your best bet is some .htaccess, but I'm a noob to that, can't help ya there.

Don't do what 64bytes has recommended. No offense, 64, but referrers aren't always set and can be disabled by the user.

@liz: Provide some code. Sessions are maintained during an Ajax call and that's what you should be using to verify. Showing us your code will help find out why you're having a problem with this method.

No. This is Jeremy of TeraTask Technologies, LLC.

Ok. There aren't really any "members", as I wrote before, but a single login for Admin options (for me), so that data can be changed, no matter if I'm at home by my computer or not.

For the login I use a class "Admin", which has some functions:

validateLogin($uname, $pword) - Compares entered username and password to stored values in config file. Returns true/false

login($uname, $pword) - validates the username and password and logs in.
After the info has been succesfully validated (with method above) I store a session as so

PHP Code:

   $_SESSION['Admin'] = array(
      'uname' => $uname,
      'pword' => $pword
   ); 


loggedIn() - Checks weather or not I'm logged in and returns true/false.
This function is used every time I need to know if I'm logged in. For example if admin should se an extra link which others don't, or to see if I'm allowed to visit a page etc. It checks this like so

PHP Code:

   return isset($_SESSION['Admin']['uname']) &&
            isset($_SESSION['Admin']['pword']) &&
            Admin::validateLogin(
                $_SESSION['Admin']['uname'],
                $_SESSION['Admin']['pword']
            ); 


Oh, and by the way. These functions are all static, if it makes any difference, so I would call them like

PHP Code:

if (Admin::loggedIn()) {
   // do things...
} 


As I said, I'm new to AJAX. I use a library called 'Scriptacolous'. With it I've made a small script for editing text for images. I use all the build in functions in Scriptacolous to make a request to 'editImageText.php' with ID and new value as parameters. In editImageText.php I tried this:

PHP Code:

require 'path/to/classes/Admin.class.php';
if (!Admin::loggedIn()) {
    exit('Error message');
} else {
   // continue...
} 


which always runs the exit command and returns the error message to the AJAX script.

Hope somebody can figure this out :P

Well, your code seems to be ok on a first look. I don't see an session_start() calls, though, so you may want to try adding those in.

The validateLogin doesn't need to be called each and every time a page is loaded -- just do it once and populate the session variable only if necessary. Then, you can assume that the session vars being set means that the values are valid.

Oh my. Am I feeling stupid now or what? (Yes, I am)
There was really nothing wrong with the code, just me not thinking straight. I have to thanks you Jeremy for mentioning that I didn't have to validate the session values every time. In 'editImageText.php' I first require the Admin class and check weather or not I'm logged in, THEN requires the config file, which holds the correct username and password. That is, the validation was always returning false because there was no username or password to compare to(!).

I simply changed the order of the two (and removed the unnecessary validation, ofcourse), and it all started working. Thanks alot!

But boy, did I waste alot of time on such a simple problem, not to mention all the text I had to write before :P

lizciz