title: Securing AJAX Requests via GUID
body: <p>I'm writing a web app that will be making requests via AJAX and would like to lock down those calls.  After a little research, I am considering using some form of random token (string) to be passed back along with the request (GUID?).  Here's the important parts of my algorithm:</p>
  
  <ol>
  <li>Assign a token to a JavaScript variable (generated server-side).</li>
  <li>Also, store that token in a DB and give it a valid time period (i.e. 10 minutes).</li>
  <li>If the token has still not been used and is within it's valid time window, allow the call.</li>
  <li>Return requested information if valid, otherwise, log the request and ignore it.</li>
  </ol>
  
  <p>With an eye toward security, does this make sense?  For the token, would a GUID work - should it be something else?  Is there a good way to encrypt variables in the request?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I understand that these AJAX requests wouldn't be truly "secure" but I would like to add basic security in the sense that I would like to prevent others from using the service I intend to write.  This random token would be a basic, front-line defense against abusive calls.  The data that would be requested (and even submitted to generate such data) would is HIGHLY unlikely to be repeated.</p>
  
  <p>Maybe I'm wrong in using a GUID... how about a randomly generated string (token)?</p>