PHP的网站安全问题？ （也可能适用于ASP / Rails /等..）

Question

Say, I have "index.htm" and "routines.php".

"index.htm" will call eventually call "routines.php" using JS (AJAX).

So, my question is, how can "routines.php" verify that the request came from the same local server and not outside? Is there a global variable I can check at PHP level or HTTP level?

Edit 1: Using AJAX

Answer 1

You may forget about the Ajax part as it's not really part of the problem. You should read about Cross Site Request Forgeries (CSRF) and CSRF tokens. Some links:

• http://en.wikipedia.org/wiki/Cross-site_request_forgery
• http://shiflett.org/articles/cross-site-request-forgeries