Q:

Ajax Security regarding user priviliges and nonces

I'm developing a plugin in which a user can upload, view and delete some private files. Obviously, a user should always only be able to work with his own files, not those of other users. 
I'm wondering if it is unwise to do any of these actions with ajax for security reasons. Mainly because https://codex.wordpress.org/AJAX_in_Plugins#Ajax_on_the_Viewer-Facing_Side states that everything executed through admin-ajax.php is executed 'with elevated rights' (under 'Note 2'). Can I still achieve secure differentiation between users and only allow access to the respective AJAX functions for the owner of the file (certainly identify user and his ID for DB selection of files) and for the admin (certainly ensure user has admin rights and grant access to all files)?
Also, how can Nonces increase security in this case? As far as I understand they are only useful if you want to restrict executing an action to a limited number or time, yet their use is highly encouraged in any article about wordpress and ajax regardless of use.

A:

The note is about the use of is_admin() to determine if a user has privileges to do something, because in every other context except admin-ajax.php, that will only be true for a logged in user. You can still use the API to determine if a user is logged in and who they are, and as long as you do that, and operate on that data, it is as safe as any other type of request.
Nonces can increase security by enforcing intent to invoke an action. Links that trigger AJAX requests can be forged by others, and if someone gets a logged in user to unknowingly click one of those links, it can invoke an action the user did not intend to. Nonces aim to prevent this by adding a unique identifier that is only good for a specific action, and expires. By checking that nonce, you can be more confident that the user intended to invoke that action and the request is not forged.

