title: Best practice: How to authenticate/authorize AJAX Calls on the server
body: <p>the last days I was wondering how is it done? How can you authenticate/authorize that the user is allowed to request the data via AJAX.</p>
  
  <p>For now I am using SESSIONS for auth.But this is only a minor protection.</p>
  
  <p>Let´s say I have some function called addUserToGroup($user_id,$group_id), which is called via</p>
  
  <pre><code>EXAMPLE: www.mysite.com/addUserToGroup/1/2  ( user_id = 1 , group_id = 2 )
  </code></pre>
  
  <p>How can I check if this user is really allowed to join group_id=2? Everyone could just POST data to my server...</p>
  
  <p>One solution I found is using jcryption (public/private key method). But I think,there must be an easier way to somehow check if user_id = 1 is allowed to join group_id = 2.</p>
  
  <p>Thanks in advance!</p>