My boss asked me to alter our Java Webapp such that users cannot go to places in our Webapp by typing URLs into their browser location bar.
I told her that I can not disable their location bars.
I told her the way this is usually done is to launch a WebApp in a new customized browser window sans a location bar.
That was not acceptable to her.
I already have a Java Filter class set up to enforce various rules. So, I was thinking of this approach
Everywhere the WebApp does a redirect or a forward, put a flag variable, say "wasRedirected" into the HTTP session.
In my Filter, intercept each request and check for the request type.
If it is a POST, I know a human didn't type the URL into their browser, so I automatically let it through.
Though it will be a lot of work, it sounds too simple to be adequate.
Is there anyway this approach can bite me in the ass?
My boss wants two problems solved
Users going to screens out of sequence and getting error messages. This includes multi-screen forms ( which we have to keep ) and users using a back button.
Preventing the user from leaving particular pages and going to other parts of the application until they fill out what we want them to fill out on those screens.
I have ideas how to solve #1 & #2, also laborious, but my boss likes the idea of disabling typing URLs for navigation for a catch-all solution.
Maybe once she sees how much work is involved in disabling typed navigation I can market her on just solving those problems.