Question

I have some situations where I want to be sure that one controller action (or route) can only be accessed by another controller action and not by being typed in. For example, I have a couple of ‘switchboard’ controller actions that resolve internal analytics, set initial values, then send different users off to their respective destinations (each destination has its own controller action).

An example of this situation: a user should only be able to view a record having gone through the switchboard action first.

Is one way to do this would be to involve perishable tokens somehow? (I am using AuthLogic in my app).

Answer 1

I have done something similar using a session. In my case an action had :

session[:boss_attack] = 1

and the other action had :

if session[:boss_attack] != 1
    redirect_to :action => 'index' and return
else
    session[:boss_attack] = 0
end  

And then i would continue with the actual action. It seems to be working fine 🙂