title: Securing an AJAX service call in jQuery and PHP (with session token)
body: <p>I'm currently building a framework in which for example <code>form</code> <code>submit</code>'s are being implemented as <code>jQuery</code> <code>ajax</code> calls to a <code>.php</code> (service) file.</p>
  
  <p>Part of the <code>jQuery</code> for reference:</p>
  
  <pre><code>var dataSerialized = $(form).serialize();
  var service = $(form).attr("action");
  $.ajax({
      url: "services/" + service + ".php",
      data: dataSerialized,
      type: "POST",
      cache: false,
      dataType: "json",
      success: function(json) {
          $(json).each(function() {
              loadPage(this.callback);
          });
      },
      error: function(json, message) {
          finalError(message);
      }
  });
  </code></pre>
  
  <p>And the <code>.php</code> does currently nothing more than:</p>
  
  <pre><code>include_once("../content/includes/connect.php");
  include_once("_functions.php");
  
  //TODO: support sending variables
  $check = true;
  $callback = "error";
  
  foreach ($_POST as $key =&gt; $value) {
      list($pass, $errormessage) = checkRules("register", $key, $value);
      if (!$pass) {
          $check = false;
          $callback = "error";
          break;
      }
  }
  
  if ($check) {
      $callback = "register_success";
  }
  
  echo json_encode(array(
      "callback" =&gt; $callback
  ));
  
  SQL::close();
  </code></pre>
  
  <p>Now I want the service call to be <strong>as secure as possible</strong>, given my situation, I see the following options:</p>
  
  <ul>
  <li>SSL cannot be used, as it is relatively too expensive. Just working on a homebred project, nothing important.</li>
  <li>jCryption library cannot be used, as I'm on a cheap web hosting and do not have access to the server itself.</li>
  <li>OAuth 2.0 is a possibility, but seems quite complicated.</li>
  <li><code>$_SERVER</code> variables can be used to help protecting the service <code>.php</code> pages, but not reliable.</li>
  <li><code>$_SESSION</code> could be used to generate tokens.</li>
  </ul>
  
  <p>I already implemented an easy measure: Change <code>GET</code> to <code>POST</code>. This will only deter the most easy attack, now the attacker actually needs to use some tampering tool instead of being able to do it directly through the browser.</p>
  
  <p>I think I can protect every call that comes from an <code>URL</code> typed in the browser, however I see two serious threats:</p>
  
  <ol>
  <li>Direct requests to the webserver: The attacker can pass any data he wants.</li>
  <li>Using a Browser JavaScript Console to send custom <code>jQuery</code> requests.</li>
  </ol>
  
  <p>I think it is best, again under these circumstances, to try to protect the service <code>.php</code> pages with <code>$_SESSION</code> tokens, but how exactly do I go about these?<br>
  They need to be set as some point in time before the service call, and then the service call could check it.<br>
  I also have access to a <code>MySQL</code> database and of course plain text files on the webspace.</p>
  
  <p>Can anyone help me out any further?</p>