diff --git a/course/rest.php b/course/rest.php
index fbc976c72a7..a90cd52ea7e 100644
--- a/course/rest.php
+++ b/course/rest.php
@@ -44,7 +44,12 @@ $context = get_context_instance(CONTEXT_COURSE, $course->id);
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
+if (!empty($CFG->disablecourseajax)) {
+    errorl_log('Course AJAX not allowed');
+    die;
+}
 
+require_sesskey();
 
 // OK, now let's process the parameters and do stuff
 
diff --git a/lib/ajax/ajaxcourse.js b/lib/ajax/ajaxcourse.js
index 3c17de75e54..03daa203554 100644
--- a/lib/ajax/ajaxcourse.js
+++ b/lib/ajax/ajaxcourse.js
@@ -220,7 +220,7 @@ main_class.prototype.connect = function(method, urlStub, callback, body) {
             callback = {};
         }
     }
-    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&"+urlStub, callback, body);
+    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&sesskey="+this.portal.strings['sesskey']+"&"+urlStub, callback, body);
 }