How to secure jQuery AJAX request on Client & Server side?

So there will be minimum risk of hack.

On server side we can use https

  • Exactly like any other request: The rule is "do not trust user data". There is nothing special about AJAX requests. – Fabian Schmengler Mar 18 '17 at 16:10

From my experience, we should consider:

On the server side:

  • Check isAjax - isXmlHttpRequest on your controller. This prevents the Ajax controller from accessing directly from Browser.
  • We can add more logic to validate the data. For example, validate the Json data, check logged customer.

See here : vendor/magento/module-customer/Controller/Ajax/Login.php

On the client side:

  • We can use lib/web/mage/storage.js for performing asynchronous GET, POST, PUT, DELETE

  • The data should be JSON string, for example: JSON.stringify({payment: payment})


return storage.post(
            serviceUrl, JSON.stringify(payload)
            function (response) {
                errorProcessor.process(response, messageContainer);
            function () {

We can read more here: https://www.owasp.org/index.php/AJAX_Security_Cheat_Sheet

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.