How to prevent POST requests from ajax (received through firebug)

Question

How can I prevent users from mailing a request? For example, a form is submitted via an Ajax post. Using firebug, I see a message, but I noticed that this request can be easily repeated by right-clicking on it and selecting "open in a new tab". How can I prevent something like this?

Answer 1

Any web form can be submitted in any way. What you need to do is make sure that the server side of the script processing the form has the logic necessary to “ignore” spam requests.

Answer 2

When a valid user logs in or starts a session, create a random token string and place it in a hidden form field. Each time a valid mail is created by a valid user, generate an arbitrary token string and store it in $_SESSION , as well as returning it to the client’s browser. When the browser makes another request to send Ajax, it should also send this token string, which you are comparing with $_SESSION .

This way you can only make an Ajax entry if your server has authorized it before. It prevents anyone who simply knows the URL of the Ajax handler from sending HTTP requests to it.

Answer 3

You cannot reliably. But you can check the HTTP_X_REQUESTED_WITH header, which is usually sent along with ajax requests. It can be faked, although it cannot be there for real ajax requests.