Storing previous URL as session data

[eluser]n0xie[/eluser]
The answer is a bit difficult. There is a security check build in which prevents cross domain POST via Javascript. This used to be part of the whole security against CSRF. But lately it has become much easier to even do cross domain AJAX POST's as shown here and here so basically even though you have to jump through hoops to get it to work, cross domain javascript POST's are possible. The best thing you can do is rely on counter measures. You can read up on the subject here: http://stackoverflow.com/questions/298745/how-do-i-send-a-cross-domain-post-request-via-javascript

I’m doing checks to make sure the user is logged in and the item being deleted belongs to the logged in user.

These checks mean nothing to CSRF. To your webserver/website it will seem as if the user actually wanted to do the action, the browser will send whatever authentication you have on your site (cookie/sessions) and the damage will be done. For normal users, the damage may be as simple as just logging out, but if an administrator were to 'fall' for the exploit, it could mean he deletes every user in the database.