Question: I want to use post to update a database and don't want people doing it manually, i.e., it should only be possible through AJAX in a client. Is there some well known cryptographic trick to use in this scenario?

Say I'm issuing a GET request to insert a new user into my database at `site.com/adduser/<userid>`. Someone could overpopulate my database by issuing fake requests.

Answer: 
There is no way to avoid forged requests in this case, as the client browser already has everything necessary to make the request; it is only a matter of some debugging for a malicious user to figure out how to make arbitrary requests to your backend, and probably even using your own code to make it easier. You don't need "cryptographic tricks", you need only obfuscation, and that will only make forging a bit inconvenient, but still not impossible.
[Prevent Direct Access To File Called By ajax Function](https://stackoverflow.com/questions/1756591/prevent-direct-access-to-file-called-by-ajax-function) seems to address the question.

You can (among other solutions, I'm sure)...

* use session management (log in to create a session);
* send a unique key to the client which needs to be returned before it expires (can't
be re-used, and can't be stored for use later on);
* and/or set headers as in the linked answer.

But anything can be spoofed if people try hard enough. The only completely secure system is one which no-one can access at all.