I have a service.php class that I use to service AJAX calls from my website. To prevent other people accessing the service using PHP CURL I would normally check the request has come from mysite, and if they are not then just redirect to my home page e.g.

if($_SERVER['HTTP_REFERER'] != "http://www.mysite.com"){
   header('location: http://www.mysite.com');
   exit;
}

I read in the PHP holy bible:

http://www.php.net/manual/en/reserved.variables.server.php

that

"Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted."

So if this method is not reliable, my question is how can I reliably check that requests to my service file have come from my website?

Thanks for any help you can provide!