Prevent Manual URL

Question

Hi,
I am using JDeveloper 11.1.1.2 with ADF BC and ADF Faces.
I have an unbounded task flow with several views including a welcome page. Currently, a user can manually enter a URL to take them to any one of the views. I would now like to redirect the user to the welcome page if he/she tries to do this.
The following post from 2007 describes how this can be accomplished by checking for a GET in a ServletFilter: Re: Faces - Preventing user from entering URL manually However, when I try to do this, I find that the commandLinks within my application are also using the GET method.
I was under the impression that commandLinks were supposed to do a POST. Is there any other way to tell if a URL was typed manually?
Here's the web.xml and filter code that I was using to test...
web.xml:
<filter>
<filter-name>UrlFilter</filter-name>
<filter-class>app.uiview.filters.UrlFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>UrlFilter</filter-name>
<url-pattern>/faces/*</url-pattern>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
doFilter Method in UrlFilter.java:
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
System.out.println("\n***Method: " + ((HttpServletRequest)request).getMethod());
chain.doFilter(request, response);
Thanks,
Brad

Answer 1

Amir/Brad,
Actually I was thinking about the possibility of using referer in a servlet filter as well (haven't had time to test this out). You could very well write a servlet filter that would look for a GET request with no referer and redirecting that to a home page. You may also have to be aware of template GET requests too. Another possibility would be (in your filter) to redirect GET requests for any of your specific JSP(x) resources except for the "home page" one - you could possibly even make this resilient against changes in your app by reading the unbounded task flow to determine all of the "safe" resources (that would allow GET requests) and unsafe ones (where you would redirect). If a GET request came in through the servlet filter for a resource that wasn't in the unbounded task flow (such as would be the case for a template), you would just pass it through.
John