How to Prevent request attacks using ajax server scripts

To prevent users from simulating logon or other requests through ajax interfaces, for example, writing a script or manually making requests to you. How to prevent it? To prevent users from simulating logon or other requests through ajax interfaces, for example, writing a script or manually making requests to you. How to prevent it?

Reply content:

To prevent users from simulating logon or other requests through ajax interfaces, for example, writing a script or manually making requests to you. How to prevent it?

1. Verify the AJAX request. For example, PHP code:

Define ('is _ AJAX ', isset ($ _ SERVER ['HTTP _ X_REQUESTED_WITH']) & strtolower ($ _ SERVER ['HTTP _ X_REQUESTED_WITH ']) = 'xmlhttprequest ');

(Environmental variables in this step can be forged, but many hacker (bai) can be filtered out ))
2. frequency limit. For IP address restrictions, you can do this at the server layer (Tengine has this function ). For the frequency limit of logged-on users, Douban does this. If the frequency is exceeded, enter the verification code.
3. csrftoken is of little significance.

First, there is no absolute solution to prevent this situation.

Second, there are only two solutions to consider:
1. Verify the routes
2. Added verification data (such as cookie and hidden input). csrftoken is similar to hidden input.

Some abnormal people will perform verification codes --#