title: Protect PHP endpoints called by AJAX
body: <p>My app consists of several PHP endpoints which are accessible via AJAX. The problem is they are also accessible via anyone who makes an HTTP request to the same endpoint. I can add checks for <code>HTTP_X_REQUESTED_WITH</code> and <code>HTTP_REFERER</code> as specified in <a href="https://stackoverflow.com/a/20337845/519497">this answer</a>, but these can be spoofed. I could add a secret key that needs to be posted with the request, but anyone viewing the javascript and/or the console would be able to see this key. What is the solution here?</p>