stateless csrf(via xhr) prevention

origin.php

if (isset($_SERVER["HTTP_ORIGIN"])) {
	if (parse_url(explode(",",$_SERVER["HTTP_ORIGIN"])[0], PHP_URL_HOST) != $_SERVER["SERVER_NAME"]) {
		header("HTTP/1.1 403 Forbidden");
		exit;
	}
}

// XHRで必ず呼ばれるはずのリクエストについてはコレも付ける
if (!isset($_SERVER["HTTP_X_REQUESTED_WITH"]) || $_SERVER["HTTP_X_REQUESTED_WITH"] != "XMLHttpRequest")  {
	header("HTTP/1.1 403 Forbidden");
	exit;
}

xrw.js

myModule.config(function($httpProvider) {
  $httpProvider.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
});