How to close directory access except for XMLHttpRequest requests?

Question

Nginx

Access to the /core/ directory and all files inside the directory is closed. From the browser we submit to 403, everything is ok.

location ~* ^/core/ {
    deny	 all;
  }

access to files via XMLHttpRequest request is also closed (
Question: how to allow access to files in a package, for example /core/ajax/search.php only for XMLHttpRequest request
The task is to protect the entire core folder, and not specifically the /core/ajax/ folder, not willing remove ajax folder from core

Answer 1

You won't protect yourself from anyone. An attacker can also send XHR.