title: API AJAX over PHP - Create a secure access to API
body: <p>I'm creating a custom e-commerce module for the web application I'm working on. We give to our users the chance to create a module for their sites that will be hosted with us into a domain e.g: <code>http://example.com</code>.</p>
  
  <p>That module has a Javascript interface into user's account administration panel. In order to access to the administration panel, they have to log in with their account into our web application.</p>
  
  <p>They can add products, change e-commerce settings (such currencies), etc. When a product is added or something is modified, calls for an URL into the user's domain, a dispatcher calls for the PHP function (add product, remove product, etc.) and modifies their databases, but if someone knows the handled URLs, can use a REST API Client to send information and it's supposed to work (e.g. sending a product ID to the remove product action). We want to prevent that from happening, because someone could delete the clients products or modify some e-commerce settings.</p>
  
  <p>We thought into using a token stored in the PHP <code>SESSION</code> when the API URL is called, return the token to the AJAX call, then do another AJAX call to the requested function with the given token. When the function is called, compares both tokens and if they are the same, then changes are allowed. Otherwise, they are rejected, but we don't know if this is a "good security" to prevent accessing to the API from outside. Because you can "find" the way to know that you have to call an URL to get an accessing token, then do another call with the given token and perform your destruction.</p>
  
  <p>Thanks in advance. Any information or suggestion will be appreciated.</p>
  
  <p>Regards.</p>