为什么阻止直接URL访问也会从Web服务器上的文件中删除Ajax调用？

Question

I want to block Url (external) access to PHP file in the folder "/mi-php/". So I created a .htaccess file within /mi-php folder with the following codes:

<Files *.php>
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Files>

Sure, the php files are blocked from directly url access. However, when I try to call this php (/mi-php/jobdata.php) file using Ajax in one file on the webserver as follows:

$(document).ready( function () { $.getJSON("/mi-php/jobdata.php", function(data){ etc etc

It is also blocked. I thought calling by another file under the same website root directory is considered "localhost" access. I guess I am wrong. But how to make the php file accessible to only my own files under the root directory?

Answer 1

I don't see that there are any bullet proof ways of solving this. The only way I can think of is to see if the call is an Ajax call.

if (empty($_SERVER['HTTP_X_REQUESTED_WITH']) || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest') {
    die();
}

Based on David Walsh blog post here.

You need to add the above snippet in the top of each file you're trying to block. There are two things to consider.

1. Anyone can modify the header of their call and add the above header.
2. Some servers/ajax-clients don't send this header (Apache and jQuery does).

There might be more you can check in your script but this would be a start.