title: Securing ajax calls in a ASP.NET MVC application
body: <p>I have an ASP.NET MVC based application that allows different levels of access depending on the user.  The way it currently works is when a user accesses a page, a check is done against the database to determine the rights that user has.  The view is then selected based on the level of access that user has. Some users see more data and have more functionality available to them than do others.  Each page also makes a variety of ajax calls to display and update the data displayed on the page.</p>
  
  <p>My question is what is the best way to ensure that a particular ajax call originated from the view and was not crafted manually to return or update data the user does not have access to?  I would prefer not to have to go to the database to re-check every time an ajax call is made since that was already done when the user initially loaded the page.</p>