Preventing improper page navigation

["Givler, Eric" <eg...@state.pa.us>]

We have an application where we'd like to prevent the user from navigating within the application using bookmarks or their history.  If they do this, in most cases, the proper queries will not have run and the application will be in an indeterminate state.

We thought the solution was to simply look at the http "referer" header and if that value was null, it meant that they did not click a hyperlink within our application when they hit the page.  Unfortunately, we have situations where this is null.  (I really don't know why this would be true, but it is.)

So, what's the solution for something like this?  We know the user is logged in, as that's another check, we just want to make sure they perform legal operations, such as:

form b
  you can get here via :
    form a only

form c
  you can get here via:
   form (b) next
   form (d) previous
   form (c) postback

Thanks for any suggestions.

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org

Re: Preventing improper page navigation

[Michael Jouravlev <jm...@gmail.com>]

On 4/6/06, Givler, Eric <eg...@state.pa.us> wrote:
> We have an application where we'd like to prevent the user from navigating within the application using bookmarks or their history.  If they do this, in most cases, the proper queries will not have run and the application will be in an indeterminate state.
>
> We thought the solution was to simply look at the http "referer" header and if that value was null, it meant that they did not click a hyperlink within our application when they hit the page.  Unfortunately, we have situations where this is null.  (I really don't know why this would be true, but it is.)
>
> So, what's the solution for something like this?  We know the user is logged in, as that's another check, we just want to make sure they perform legal operations, such as:
>
> form b
>   you can get here via :
>     form a only
>
> form c
>   you can get here via:
>    form (b) next
>    form (d) previous
>    form (c) postback
>
> Thanks for any suggestions.

You can either have different addresses for you pages, then when a
user navigates to a page, check current status and jump to allowed
page.

Or you can have one address, and display a view depending on current
user state. If you ok with using session, then take a look here:

Live Demo: http://www.superinterface.com/wizard/signupWizard.do
Samples: http://sourceforge.net/project/showfiles.php?group_id=49385&package_id=154597&release_id=398869

Michael.

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org