php - Securing REST API using HTTP_X_REQUESTED_WITH and SESSION IDS -


i'm building api website , want api accessible own website. way i've built call php file using ajax:

    <?php session_start(); ?>     <script>         $.ajax({             type: "get",             datatype: "json",             url: "secureapi.php",             data: "test="+document.cookie.substring(document.cookie.lastindexof('phpsessid')).replace(/phpsessid=/gi, '') + "userid=123",             success: function(response){                 console.log(response);             }         });     </script> 

in php file check if it's called xmlhttprequest , session_id correct:

<?php      session_start();      if(strtolower($_server['http_x_requested_with']) == 'xmlhttprequest' , $_post['test'] == session_id()){         //query database , return json     }  ?> 

is secure enough or can session_id curl or something?


Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

c++ - qgraphicsview horizontal scrolling always has a vertical delta -