从ajax / javascript滥用中保护php代码

Question

I am designing a website, and I really want it to be as secure as possible. I have a private folder that cannot be accessed (.htaccess) which contains all my php classes (and similar structures), and a public folder that has my Javascript, CSS and a PHP file for the Javascript(via AJAX) to interface with, which in turn accesses the classes in the private folder.

Now here is my issue, and for the life of me I just cannot seem to get my head around this one:

If someone was to look at the js code they would see the commands / data being sent to the publicly available PHP Script (as described above), therefore getting an idea of what commands to use interface with that script and potentially gain access to stored data etc.

now I know that ajax wont work remotely etc but as long as you got the commands from the ajax script you could interface directly with it, so i thought i would do a referrer check on the interface script and that worked perfectly until I realized how easy it was to spoof your referrer header!

does anyone have any ideas on how to secure this. if this just sounds like complete garbage tell me and I'll try and break it down further.

Answer 1

AJAX and JS are client-based - everything they do, any user can do. If you expose an API method to AJAX, you expose it to the user - there's nothing you can do about that. That's your design choice. You could of course obfuscate your API calls, but that doesn't really do anything other than make it less user-friendly.

The bottom line: don't trust any user input, regardless of whether it came from your AJAX code or somewhere else.