Search code examples
phpjqueryhttpcsrfreferer

How to verify JQuery/AJAX referer to prevent CSRF?

if ($_SERVER['HTTP_REFERER'] == "????")

What would the HTTP_REFERER be if this page was reached by a JQuery $.post request?

Solution

  • try 

    strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest')

    Note That not all servers provide this variable

    and you can read this Detecting Ajax in PHP and making sure request was from my own website