I have a site that uses ajax calls to perform a number of functions. They have the webbrowser call back to a script - ajax.php. Though I use post data to transmit the data and limit the commands that the ajax script can call, there is really nothing preventing users from spoofing ajax calls to attempt to manipulate the site. Is there some blanket way to prevent users from spoofing the calls? Is there a way to ensure that an ajax call does in fact come from my website and not from some other script or site?
Or do I simply have to check the boundary conditions in the php script and prevent the users from spoofing things they wouldn't be allowed to do, but allow them to spoof where they would be allowed.