Question

I have two URLs, A and B. I want to prevent users from directly accessing B, and would like to enforce a ‘rule’ such that one can only access B after visiting A. More specifically, the only route to land on B is via a redirect on A.

I was thinking to use some js in B to check document.referrer, if it is not A then redirect the user out of B. However, this may not work in my case as B is reached using a redirect, in which case document.referrer would not give me A.

I would also prefer, if possible, not to have to do the check using js after the content of B is loaded, which would help saving some bandwidth.

Is there any effective and robust method for doing this?

Answer 1

You should have page A set a cookie, and page B check for the existance of the cookie. It is not foolproof nor 100% robust, but it is the accepted method for enforcing such restrictions in stateless applications such as the web.