如何拒绝直接访问AJAX目录中的文件

Question

I have several pages that call in content via jQuery .ajax. I dont want the content visible on the page so thats why I went with .ajax and not showing/hiding the content. I want to protect the files inside the AJAX directory from being directly accessible through the browser url. I know that PHP headers can be spoofed and dont know if it is better to use an "access" key or try doing it via htaccess.

My question is what is the more reliable method? There is no logged on/non logged user status, and the main pages need to be able to pull in content from the pages in the AJAX directories.

thx

Answer 1

Make a temporary time-coded session variable. Check the variable in the php output file before echoing the data.

OR, if you don't want to use sessions.. do this:

$key = base64encode(time().'abcd');

in the read file: base64decode explode by abcd read the time. Allow 5 seconds buffer. If the time falls within 5 seconds of the stamped request. You are legit.

To make it more secure, you can change your encrypting / decrypting mechanism.