Re: What is the best way to protect the PHP page thatreturns the AJAX data?
| From: | Robert Cummings | Date: | Fri, 11 May 2007 14:00:16 +0000 |
| Subject: | Re: What is the best way to protect the PHP page thatreturns the AJAX data? | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-254801@lists.php.net to get a copy of this message | ||
On Fri, 2007-05-11 at 10:33 -0300, Rangel Reale wrote:
> That was only an example, the question is, how do I protect possibly
> sensitive data sent by AJAX, so one user can't access other user's data?
>
> Is the anwser just "don't do this with AJAX"?
No, do what you would normally do. Filter access to data based on the
user's permissions. Ajax requests are like any other http request.
Cookies are sent. If you aren't using cookies and relying exclusively on
PHP trans SID or something similar, then just make sure the ID is sent
in the Ajax request. Then as with any request, check permissions and
dole out information appropriately.
Cheers,
Rob.
--
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com
|
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting |
| a powerful, scalable system for accessing system services |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for |
| creating re-usable components quickly and easily. |
`------------------------------------------------------------'