php - Is an X-Requested-With header server check sufficient to protect against a CSRF for an ajax-driven application? -

i'm working on ajax-driven application requests pass through amounts main controller which, @ bare bones, looks this:

if(strtolower($_server['http_x_requested_with']) == 'xmlhttprequest') {     fetch($page); } 

is sufficient protect against cross-site request forgeries?

it's rather inconvenient have rotating token when entire page isn't refreshed each request.

i suppose pass , update unique token global javascript variable every request -- somehow feels clumsy , seems inherently unsafe anyway.

edit - perhaps static token, user's uuid, better nothing?

edit #2 - the rook pointed out, might hair-splitting question. i've read speculation both ways , heard distant whispers older versions of flash being exploitable kind of shenanigans. since know nothing that, i'm putting bounty can explain how csrf risk. otherwise, i'm giving artefacto. thanks.

i'd it's enough. if cross-domain requests permitted, you'd doomed anyway because attacker use javascript fetch csrf token , use in forged request.

a static token not great idea. token should generated @ least once per session.

edit2 mike not right after all, sorry. hadn't read page linked properly. says:

a simple cross-site request 1 that: [...] not set custom headers http request (such x-modified, etc.)

therefore, if set x-requested-with, request has pre-flown, , unless respond pre-flight options request authorizing cross-site request, won't through.

edit mike right, of firefox 3.5, cross-site xmlhttprequests permitted. consequently, have check if origin header, when exists, matches site.

if (array_key_exists('http_origin', $_server)) {     if (preg_match('#^https?://myserver.com$#', $_server['http_origin'])         dostuff(); } elseif (array_key_exists('http_x_requested_with', $_server) &&         (strtolower($_server['http_x_requested_with']) == 'xmlhttprequest'))     dostuff();