Prevent the user from calling action method directly

Question

I have 3 View like this:

  public ActionResult Index()
    {
         return View();
    }

    public ActionResult Step2()
    {

         return View();
    }
    public ActionResult Step3()
    {
         return View();
    }

And 3 HttpPost Actions

    //Step 1
    [HttpPost]
    [ValidateAntiForgeryToken]
    public JsonResult Index(string number){}
    //Step 2
    [HttpPost]
    [ValidateAntiForgeryToken]
    public JsonResult Step2(string number){}
    //Step 3
    [HttpPost]
    [ValidateAntiForgeryToken]
    public JsonResult Step3(string number){}

For each HttpPost Action Method I have created a HTML Form and I want that the user submits each form step by step (step 1 -> step 2 -> step 3)

Everything is OK but I do not want users can go to redirect domain/controller/step2 or domain/controller/step3. I mean, user must follow my router step 1 -> step 2 -> step3

possible duplicate of [Asp.net mvc How to prevent browser from calling an action method?](https://stackoverflow.com/questions/9407172/asp-net-mvc-how-to-prevent-browser-from-calling-an-action-method) — Maddie, Dec 01 '19 at 04:47
So, your question seems to be a matter of route priority. You'll find this thread useful: https://stackoverflow.com/a/25908768/4687359 — A. Nadjar, Dec 01 '19 at 05:15

score 2 · Accepted Answer · edited Dec 01 '19 at 14:30

There are ways to solve your issue. One way to achieve this is by using TempData before your redirect command and check the TempData value in your HttpGet Action Method. For example for your Step 2 check you can do this:

[HttpPost]
[ValidateAntiForgeryToken]
public JsonResult Index(string number)
{
    //your business code 

    TempData["FirstStepDone"] = true;

    // return RedirectTo()
}

public ActionResult Step2()
{
    if (TempData["FirstStepDone"] == null)
        //return error

    return View();
}

Prevent the user from calling action method directly

1 Answers1