How a server can check ajax requests not from a site, X-Requested-With

Question

I read that checking the X-Requested-With header from an ajax request is a good way to make sure the request is not coming from outside. How can I check this header on the server side? and what is the correct way to respond to this header is missing or incorrect (redirect, throw exception, else)?

Answer 1

You can check it like this:

$isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) AND 
          strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest';

If you are only waiting for access via XHR, then simply exitif this header is not there.

Note . This title is trivial to replace. Don't rely on it for anything, but it looks like it came from na XHR.

Answer 2

, , - , - . , AJAX, , , , .

: http://en.wikipedia.org/wiki/Cross-site_request_forgery