5

I have built a site that when a user fills in a form correctly he is redirected to a confirmation page that has the url mySite.com\A\confirmation.

I want to be able to redirect the user to a different page If he enters that url "mySite.com\A\confirmation" himself

What is the best way of achieving this (i was hoping something more elegant then keeping state of each user)

3
  • And exactly what good reason do you have to do this? Feb 24, 2012 at 14:56
  • I don't want anyone posting a link to confirmation page. its supposed to be a one time view-able page. mostly to confirm interaction between users, i want to be the only one able to redirect a user there.
    – james
    Feb 24, 2012 at 15:46
  • If it is a validation page, that's means you already have information saved somewhere. On load of the page simply check if that data is present. If not, redirect. Feb 24, 2012 at 16:04

3 Answers 3

4

Possible simple solutions:

  1. Store some key in cookie, verify it on confirmation page and clear. Cookie value should be encrypted, so user won't be able to forge it (if not, you can use Crypto.encryptAES(String), Crypto.decryptAES(String) manually.
  2. Change confirmation controller to accept parameter, pass that parameter from form submit controller: confirmation(secureParameter); Validate parameter in confirmation method.
  3. Do POST request to confirmation from your code and change routes and redirect on GET requests
  4. Instead of redirect to confirmation in your controller, simply render confirmation template directly, this way there would be no confirmation URL.
2

You could put a token in the flash scope and redirect to mySite.com\A\confirmation

If the token is not there redirect him to another page, otherwise display the page and keep the token in the flash scope. If you keep the token in the flash scope, the user will be able to reload the page without being redirected.

2

It won't be simple, as you may find lots of edge cases.

When you do a redirect, Play sends a 303 HTTP code and the browser does a new GET request against the URL. You could try to add a parameter to check, but then the user could add that to the navigation bar and the request will work.

Also, you would be violating Idempotence in GET. Not a good thing to do, as browsers may rely on it.

Better add a check in the same page and if the form has not been submitted, just show a message or throw a 404 error (not found).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.