Adding security layers to prevent AJAX botting as much as possible - php

Question

I'm not sure if the title is correct way to ask this question, but here it goes.
Case:
I'm using CodeIgniter (2.1.3) to make AJAX calls and fetch JSON data. Being aware that you can't really "secure" AJAX as the JavaScript is always accessible by the user I was wondering what are the possibilities to make it as hard as possible for people to automate the AJAX calls.
Let's say you have a game where you keep requesting queue data for constructing buildings and training troops. If I would want to bot that website I could just find out how the AJAX calls work and make a script to log myself into the domain and call the AJAX calls manually.
The goal of doing this is; Might 10000 people try to bot the website, the layers of hinderance I would build into the AJAX calls might reduce those 10000 to maybe 100, thus making it easier to track for the administrators who still managed to cross all layers.
In this case we can also see what they are doing and try to add more checks/layers to prevent the majority to be able to bot the website.
Confirming an actual session
The first layer I was thinking of is the passing of a random hash to the page that is loaded and storing that hash in the PHP Session too. This way the visitor can "only" get JSON back from the AJAX calls that get the hash value that was given to that single page load. So if they try to fetch the HASH with a regular expression match in one cURL/wget call, they can't use it in the call to fake the AJAX call.
I still think there is an issue here with multiple page loading tho. I might be tracking if people are opening a new page under their login-name and give them a message they may not operate on multiple pages to work with the application. Also it might be problematic with automation tools like Selenium.
In CodeIgniter I do this now:
<?php
public function index()
{
$this->load->helper(array('security', 'url'));
$this->load->library('session');
$data = array();
// AJAX Security
$data['hash'] = sha1(hash('md5', (microtime() - rand(0, 1^3)) * rand(0, 1^12)));
$this->session->set_userdata('live_hash', $data['hash']);
$this->load->view('jqueryjson', $data);
}
public function xhr()
{
$json_data = json_decode($data_set);
if (isset($data_set['hash']) AND $data_set['hash'] == $this->session->userdata('hash')) {
echo 'HASH security layer passed<br />';
echo json_encode(array('JSONDATA TO BE SEND BACK'));
}
else {
echo 'Please do not call the page outside a browser.';
}
}
?>
I know this approach is kind of naive, but I'm wonder how others do this (client-side) to prevent the majority of botters. Off-course I'm also validating all the passed data on the server-side to be sure no data is customized outside the standards the data should have.

Answer 1

I think this problem isnt only bound to ajax calls, but to every request made in a webpage.
To prevent access by automatons most sites use some kind of captcha images.
Idea:
Maybe you could place the graphical elements to trigger the ajax calls in varying places inside an image, so that only a human would click on them on the right spot. I am thinking of an image showing the element of which only you know the position. You simply send the position of the click inside the image with the ajax-request and compare if it was the right spot...
2.Idea:
Open up a captcha-window after 10 ajax-requests made too fast with an image inside, so that
the user has to verify himself as a human. Without the verification no ongoing game.
Maybe you could build the verification somehow in the game, so that a user doesnt see it as a captcha right away.
Lucian