Re: Preventing direct URL access in a J2EE environment

[Roy Britten <r.britten () niwa co nz>]

On Wed, Mar 02, 2005 at 07:54:48AM -0500, Kevin Conaway wrote:
> I just want to enforce that users actually click on a link to go to a
> certain page, not type in the URL manually.

As noted, attaching single-use tokens to each request is the most
reliable way of achieving this. A lower-overhead approach (but
spoofable, with effort) may be to deny all GETs to the server (other
than to the initial "home" page) and have every link submit a POST
request.

Roy.