[eluser]Tim Post[/eluser]
[quote author="gwerner" date="1338585963"]
One last question. What is the best practice for handling the request if it is not AJAX? Considering I didn't even know you can check for this I'm curious what might be the best way to handle non-AJAX requests. My first inclination would to simply redirect or do nothing since the view the user would be on is the index. The controller below is only accessed if the user clicks the delete link or type in the URL. If they click the link all should be well. If they try to type it in then it should just do nothing. That's what the link is for?
[/quote]
I just log it, depending on the potential destructiveness of the call. It really depends on your app. It could simply be a buggy user script or extension, or perhaps someone poking at things that they shouldn't be. So at the least, just talk to log_message() and then send a blank page after setting the HTTP response (400 / 403 would be appropriate).
If you're writing something where some people would be inclined to find ways to 'cheat', those kinds of requests are a good place to put a little more logic.
I haven't sawed through my collection of logs, but I'm going to venture that 90% of those requests I see come from bad (as in evil) or broken (poorly written) bots.
