How to secure ajax on automatically save field data My custom module make ajax request on _node_edit form after input changed by user, and menu callback save this field's data (only this field, not all node object). Menu item is as "field-save/NID/FIELD_NAME", and the input val is on $_POST['field_data']. Menu item have own permission per role. Additionally each user have own randomly generated secure string and it is on the same ajax $_POST['secure_phrase']. Menu callback checking for permission per role and this secure string per user, if have access going forward to save field data.

The question: Is this enough security to prevent for unauthorised access to save field through this ajax request?

edit:
additional for this on "access_callback" i have

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) &amp;&amp; strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
  // checking permissions here
}
It seems pretty secure. Also check the content type permissions for the role ;)