title: Security of URL called via AJAX
body: <p>How do you properly lock down the file called via AJAX? How do you stop someone from calling the response URL directly and getting a response?</p>
  
  <p>To help explain, I'll use an example of an auto-suggestion feature; Specifically, typing in a few letters will bring up a list of all members that match that phrase.</p>
  
  <p>So somewhere in the Javascript you define url of "http://mysite.com?code=". Then in the look up script we have</p>
  
  <pre><code>loginRequest.open("GET", url + characters, true);
  </code></pre>
  
  <p>and it returns XML of all members that have "characters" somewhere in their name. What is to stop a hacker from entering that URL directly into a browser and repeatedly sending new name snippets in an effort to get my entire member base?</p>
  
  <p>No web example I've come across seems to address this concern.</p>
  
  <p>Am I just being (incorrectly) paranoid?</p>