Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm trying to come to an accurate decision here about safe ajax requests from a template.

The thing about AJAX that always scares me is that the called script location is public:

http://www.mydomain.com/wp-content/themes/mytheme/inc/myscript.php

I just don't feel comfortable with that kind of public knowledge.

Is there a proper way of keeping prying eyes out of that script while still being able to make AJAX calls confidently?

share|improve this question
    
BTW, just curious, what's up with the 43% accept rate? I see you've asked 17 questions on WPSE. It's good to accept an answer for the betterment of the community. If someone has the same question, an accepted answer lets them know the exact solution. –  Brian Fegter Aug 27 '12 at 3:24
add comment

2 Answers

up vote -1 down vote accepted

Security through obscurity isn't a good pattern to follow. You have to have a URL to make XHR or JSONP calls. Anyone who knows anything about searching the DOM using developer tools, Firebug, etc... can easily find your remote script URL. To me, this is the wrong question to ask.

The more relevant question to security is, how do I harden my AJAX handler script from unwanted intrusions?

The simple answer to this question is to use WordPress nonces for verifying the authenticity of the request.

There are other functions you can use if you want to make sure the request came from wp-admin or simply verify a nonce outright without an API function.

Check out this page in the Codex for more information about WP Nonces.

You can also use conditionals like current_user_can() to add additional layers of security for privileged AJAX requests. If you find that someone is abusing that script, start logging IPs. If requests fail to meet criteria after so many tries, block the offending IP addresses.

The bottom line is make sure your code is secure. Hiding or obscuring scripts is not a good alternative to proper security. Snoopers will find what they want if they are motivated enough.

share|improve this answer
    
Can I not just use wp_create_nonce and then my own custom functions.php? –  dcolumbus Aug 27 '12 at 3:08
    
@dcolumbus Not sure I understand your question. –  Brian Fegter Aug 27 '12 at 3:09
    
Instead of using the Wordpress admin-ajax.php and it's method of handeling AJAX, can I not use my own "myajax-function.php" and call that with nonce? –  dcolumbus Aug 27 '12 at 3:12
    
@dcolumbus It's the same exact thing at the end of the day. There's no difference of security in you using your own ajax handler rather than the native WordPress handler. I've used admin-ajax.php for many enterprise level sites and we've never had an issue at all. Using admin-ajax.php means you're routing WP to a callback function of your choosing. –  Brian Fegter Aug 27 '12 at 3:16
    
I'm trying to determine where to draw the line with WordPress ... what should I be including into myajax-functions.php file? –  dcolumbus Aug 27 '12 at 3:18
show 1 more comment

Yes don't use that script and use the secure one WordPress provides for you.

wp-admin/admin-ajax.php

Please read AJAX in Plugins

In response to comments.

You can use wp-admin/admin-ajax.php from the front end. You just need to make sure it is defined as your ajaxurl then your php function needs to hook into
add_action( 'wp_ajax_nopriv_your_action', 'your_callback_function' );

The nopriv flag makes it accessible from the front end.

share|improve this answer
    
Yes, but these requests are not from the WP Admin. They are from the front-end. –  dcolumbus Aug 27 '12 at 2:51
    
@dcolumbus You can still use admin-ajax.php for an AJAX handler on the front-end. –  Brian Fegter Aug 27 '12 at 3:02
    
@dcolumbus, I think the concept is same for using AJAX from front-end as well. You can have a look on the following video tutorial for better understanding: http://www.youtube.com/watch?v=7pO-FYVZv94. Cheers. –  Mahmudur Aug 27 '12 at 3:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.