Take the 2-minute tour ×  I have a facebook application, and
some functionalities require some sripts running via ajax. Is
there a way to ensure that the script is only called from inside
my app? I use jquery for the ajax calls like this:
$.post('script.php', {var1: val1, var2: val2},
function(data){...});    The code inside script.php runs some
sql queries and just check that all requested variables are
passed through the ajax call. What else should i check so that
the script can only execute if called from my app and not by
explicit calls?  Thanks in advance.  share|improve this question
add comment  4 Answers  up vote 2 down vote accepted  There are
very few ways that you can make sure with 100% certainty that
the Ajax request is being called from your app. If that was a
mission-critical (high-security) requirement, then I would
secure it the same way that I would secure any particular web
resource:    1. Use SSL   2. Require a login gateway to
establish a session   3. Check the validity of that session b