How can I prevent a direct url call in an ASP.NET/IIS environment?

Question

How can I achieve in an ASP.NET application that the set of URLs / ASPX pages (parts of the application) cannot be called directly from the user in the browser? These URLs can only be specified in the application itself.

Answer 1

You can not. If the user can go to the page, he can call it directly. You cannot control people's browsers ...

One option is to look at the HTTP_REFERER header if it is empty or has a redirect of unexpected value. This means that your application will need to install it.

(, "X-my-app" ), , .