Prevent user going to pages through address bar - jsf

Question

I have a web application. After user login, I want the user to navigate pages by clicking on buttons or links instead of manually changing the url on the browser address bar. I saw a few posts we can use security constraint to do so. I have this in the web.xml. But seems like it does not work.
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<security-constraint>
<display-name>Restrict raw XHTML Documents</display-name>
<web-resource-collection>
<web-resource-name>XHTML</web-resource-name>
<url-pattern>/faces/*</url-pattern>
</web-resource-collection>
<auth-constraint />
</security-constraint>

Answer 1

I really do not like this approach. There are a few things which user expect when using a web application and for the best user experience you should not try and change the way, users use the browser.
However, if you really want this, one of the following could be done:
You could instrument all of your links and intercept the click from javascript. When clicked, the interceptor should create a cookie which contains the path that the link was referring to. When the user requests a page, you should check if their cookie contains the requested url, otherwise redirect them to homepage.
You could generate a token for each url, and append it to the end of the url, so http://blabla.com/mypage would become http://blabla.com/mypage?token=298347287.
The token would incorporate information about the url and would have a timeout, after which it is no longer valid. Then you would check the validity of the token, which would verify that the user indeed clicked on the link, not just entered the url (note: it still could happen that the user enters the url containing the token by copying it from the link).