如何避免登录用户通过控制台使用ajax？

Question

Im using this ajax function to insert a product from an eccommerce site into the database.

I see that this method is very insecure, some experienced users with programming knowledge can use this ajax and insert products , or something else.

I read in others post that propose as a solution to use hidden input fields with a token, but as I said some experienced users with programming knowledge will find it.

Is there some REAL way to make this "add product" function secure without refreshing the page in every insert?

$(document).on('click','#save',function(e) {
      var vidArt = $(".imagepreview").attr('value');

      $.ajax({
             data: {idArt: vidArt},
             type: "POST",
             url: "classes/add_to_cart.php",
             success: function(data){

             }
    });
 });

Answer 1

It doesn't matter if you design your API to be used by Ajax or by whole new page loads. An HTTP request is an HTTP request and people can make whatever HTTP requests they like.

There is no way to ensure that an HTTP request comes from code you have written.

However, that should not matter. If you are going to let the user add_to_cart using the user interface you designed, why worry if they add_to_cart using a user interface they designed?

If you want to impose restrictions (such as "Only products with an X in the name can be added") then impose those restrictions using your server-side code and not the user interface.

Answer 2

u can detect console is open:

function isConsoleOpen(){
if((window.outerWidth - window.innerWidth)>100){return true;}
if((navigator.platform=="Win32")&&(navigator.userAgent.indexOf("Windows ")==-1)){return true;}else{return false;}

}

Github JS Interface