get parent url in ajax page using php

[vjayis]

hi

i hav a front page from which an ajax page is called and an text field is written in the front page using this ajax page.

I need to validate the user access for this page:

1.the ajax page should be executed only when it is called via ajax(i,e) when the ajax page URL is typed in the address bar it should not show its contents.

2.or the parent page(i,e) the front page url should be taken without the knowledge of the users in the ajax page (i,e) without passing the url into the ajax page via js. so that i can validate valid users to access the ajax page.

Any ideas??

regards
vijay

[Ciary]

actually it isn't that difficult. you just do an ajax request using POST. there you send the URL of your main page. then in your PHP page, you detect if your $_POST['url'] is empty. if it isnt, you execute the php on your page.

EDIT:
some example code

function send(){
                XMLHttpRequestObject = GetXmlHttpObject();
                var sended = "data="+data+"&url="+url;
                var request = "yourpage.php";
                XMLHttpRequestObject.open("POST",request,true);
 
                XMLHttpRequestObject.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
                XMLHttpRequestObject.setRequestHeader("Content-length", sended.length);
                XMLHttpRequestObject.setRequestHeader("Connection", "close");
 
                XMLHttpRequestObject.send(sended);
}
 

this would be your request object but i guess you already have that.

function GetXmlHttpObject() {
                try{
                    XMLHttpRequestObject = new ActiveXObject("MSXML2.XMLHTTP");
                }catch(exception1){
                    try{
                        XMLHttpRequestObject = new ActiveXObject("Microsoft.XMLHTTP");
                    }catch(exception2){
                        XMLHttpRequestObject = false;
                    }
 
                    if(!XMLHttpRequestObject && window.XMLHttpRequest){
                        XMLHttpRequestObject = new XMLHttpRequest();
                    }
                }
 
                return XMLHttpRequestObject;
            }
 

[vjayis]

yes probably i can do like that.,

but in this case as u said when i post data from the front page to the ajaxpage it can be viewed by the user when he views the pagesource and the user can access it by just posting the data directly into the ajax page from his own designed html page.

this should not be done...

[Dormilich]

most people won't do that, because
- they don't know anything about how websites work
- they don't want to (or don't care)
- it's too much work to do

despite that, you still can use a session to prevent "unauthoriz ed" access. but you can't stop people looking at your code. another possibility would be using Java Applets (but that's a totally different story)

[Ciary]

other things you can do to secure it: putting your ajax request in a seperate js-file. or use SSI file. this will prevent the code from showing in pagesource.

one thing you'll never be able to work around is firebug. it will always make your Ajax requests readable. so whats the point in trying to hide it?
posting data is very difficult(as dormilich said) thats why most 'secure' Ajax-requests use posts rather then get.

[Markus]

@vjayis
It's not a huge deal where the data comes from, as long as it is validated/sanitised.

[vjayis]

thanks for ur reply guys.

[Frinavale]

Vjayis,

If your ajax page contains sensitive data that should only be displayed to people who are authorized (have permissions) to view this content you should consider implementing a system for user authentication/authorization (as Dormilich suggested in post 3).

This should be implemented in your server code because, as you have discovered, it's hard to do using a client side approach.