Question

I want to make sure that my visitors (not authenticated users), are unable to visit a particular view without coming directly from a “previous view”. I’ve kind of had to manually create a form preview and confirmation state. It’s the step between submission and preview, and preview and confirm I’d like to “secure”.

form submission-view -> preview-view -> confirm-view.

Is there some way that I can create a unique hash, POST it, and check if it’s correct, or somewhat generate a cookie, session — or anything else that feels clever?

I’m a Django beginner (programming beginner in general) and any snippets’ or pointing me in a right direction would be very much appreciated!

Thanks.

Answer 1

There are at least two ways you can accomplish this that I can think of:

One would be to include a hidden field in your form or querystring value that contains your hash/unique that you want to pick up in the next view. If it’s not there, or incorrect, redirect.

Another would be to check the referring url from the request.META to see if they’ve come from the view you want them to come in on first, and save a session value from the form submission to carry through the rest of the views. If it’s not there, redirect. If the referring URL isn’t what you expect, redirect.

Whether you use a cookie, session, querystring parameter or hidden form post, it’s all doing the same thing – validating a value exists. Whatever method works best, is what makes the most sense for you as the developer and most likely maintainer of said app.