Making an Ajax Handler, need to ask some security questions

user_8455508 0
Viewed 22

I have a website where logged in users can follow other users, each user is stored in a MySQL database, in this database there is a table that has each user session, when a user logs in, it generates a unique session ID for that device and stores it in the users browser as a cookie.

When a user clicks the HTML button on a webpage to follow another user, I want it to send a javascript XMLHttpRequest to this PHP file I'm making, however I'm not sure what kind of security measures to take, currently I require the ID of the user to follow/unfollow and the unique session id cookie value of the logged in user.

Basically, this "cookie"/session with the unique id, I want to know if it's good enough for doing ajax calls, it's kinda like a REST API, however, it can make changes to the database via PHP when the method is POST.

If you can think of any possible issues with this please let me know, I would sure appreciate it, and if anyone has any tips on making these kinds of Ajax API's please let me know.

Cheers!

api php json ajax javascript
1 Answers

While ajax request have session id, and user login in session, its secure to accept that request to make changes what regular user may do. Keep in mind all other security issues as for usual request or ajax, no matter, like changes to db, or other, so everything is limited to user functionality, then it secure.

user_53397760
Related