如何防止恶意使用jQuery post处理程序？

Question

I use jquery POST calls to fetch data to display in various sections of my websites.

Usually, they POST to a single 'ajax_handler.php' page which reads the requested parameters and returns the relevant data. Typical parameters might be 'get_order_details',123

How could I stop users posting to the script to try and retrieve data which they should not be able to? I know I can verify that data belongs to the currently logged in user, for instance, but how could I stop users 'guessing' that there might be a handler for 'get_some_info'?

Since users could even run javascript straight from the URL this seems to be a major security problem to me as the client would have access to SESSION and COOKIE data (which I would otherwise use for security).

I guess I could start by naming each of my handler identifiers with a random string, but I'd prefer not to compromise the legibility of my code.

Answer 1

Naming your handlers with a random string is security through obscurity and while it might slow someone down, it won't stop them.

The best thing to do is to store a session or database checksum each time a page is accessed. Then also send that same checksum along with the POST content. When the form is submitted, through AJAX or otherwise, you compare the checksums. If they don't match then you know the user wasn't on the appropriate page and is trying to access the handler through some other method.