Laravel allow route to be accessible only from another route

Question

I have /signup/select-plan which lets the user select a plan, and /signup/tos which displays the terms of services. I want /signup/tos to be only accessible from /signup/select-plan. So if I try to go directly to /signup/tos without selecting a plan, I want it to not allow it. How do I go about this?

Answer 1

In the constructor, or the route (if you are not using contructors), you can check for the previous URL using the global helper url().

public function tos() {
    if ( !request()->is('signup/tos') && url()->previous() !=  url('signup/select-plan') ) {
        return redirect()->to('/'); //Send them somewhere else
    }
}

Answer 2

In the controller of /signup/tos which returns the tos view just add the following code:

$referer = Request::referer();
// or
// $referer = Request::server('HTTP_REFERER');

if (strpos($referer,'signup/select-plan') !== false) {
//SHOW THE PAGE
}
else
{
dd("YOU ARE NOT ALLOWED")
}

What we are doing here is checking the HTTP referrer and allowing the page access only if user comes from select-plan

Answer 3

You are need of sessions in laravel. You can see the following docs to get more info: Laravel Sessions

First of all you need to configure till how much time you want to have the session variable so you can go to your directory config/sessions.php and you can edit the fields 'lifetime' => 120, also you can set expire_on_close by default it is being set to false.

Now you can have following routes:

Route::get('signup/select-plan', 'SignupController@selectPlan');
Route::post('signup/select-token', 'SignupController@selectToken');
Route::get('signup/tos', 'SignupController@tos');
Route::get('registered', 'SignupController@registered');

Now in your Signupcontroller you can have something like this:

public function selectPlan()
{
    // return your views/form...
}

public function selectToken(Request $request)
{
    $request->session()->put('select_plan_token', 'value');
    return redirect('/signup/tos');
}

Now in signupController tos function you can always check the session value and manipulate the data accordingly

 public function tos()
 {
     $value = $request->session()->get('select_plan_token');
     // to your manipulation or show the view.
 }

Now if the user is registered and you don't need the session value you can delete by following:

public function registered()
{
    $request->session()->forget('select_plan_token');
    // Return welcome screen or dashboard..
}

This method will delete the data from session. You can manipulate this. You won't be able to use in tos function as you are refreshing the page and you want data to persist. So its better to have it removed when the final step or the nextstep is carried out. Hope this helps.

Note: This is just the reference please go through the docs for more information and implement accordingly.