Authenticaion bug in ajax connections

[Hadi Mollaei]

Hi.

Today I wanted to make my module Ajax connection safety so users with no administration permissions can not send success request.

After 2 hours I could not find right solution.

I tried some other modules Ajax requests. Unfortunately some of them work after I logout from admin panel.

I made a movie you can see at attached file.

Of course  the request has a token but in my opinion the ajax request should not work with the token though.

After all, I want to make my module Ajax file safety. Is there a official way to do that, like Tools?

Thanks for answering.

prestashp_ajax_bug.mp4