Prevent direct access to a webpage by typing the URL

Question

So I'm hosting my website (let's call is abc.com ) on goDaddy.

I have a login page ( abc.com/login.html ).

Which takes me to a second page called booking ( abc.com/booking.html ) once the login credentials are verified.

So I don't want people to be able to just type abc.com/booking.html and access it. I want them to go to abc.com/login.html and then go to abc.com/booking.html

So I came across 2 ways to fix this -

1. Include a validating php script in booking.html and changing the extension from html to phtml. -> This didn't work for me
2. Include a .htacess file. -> I'm not really sure how to do that

Answer 1

so your login screen should already have session code implemented into it that has a variable that specifies if the user is logged in or not. If you don't have that implemented yet, the code would look similar to:

<?php session_start();//at the very top of the page
?>
//... your own code
//if the user successfully logs in then:
$_SESSION['authenticated']=true;

Then on the booking.php page (it should be php to allow php scripts which is super important for validating if a user is logged in), you would then check if the user did log in. If he did, the rest of the page loads, if he didn't, you would redirect them to login.php:

at the very top of booking.php:

<?php session_start();
if (!isset($_SESSION['authenticated']))
{
    //if the value was not set, you redirect the user to your login page
    header('Location https://www.example.com/login.php');
    exit;
}
else
{
   //if the user did login, then you load the page normally
}

Answer 2

1. Use $_SESSION or
2. Pass a variable from login.php to booking.php. And then authenticate every user based on the variable passed using the $_POST method.

eg.

if (!isset($_POST['auth'])) {
 // redirect user back to login page
} else {
 // successful login
}

Answer 3

You can do it like

rename extensions of all pages where you want this authentification

eg

login.html >> login.php
booking.html >> booking.php
booking-suceess.html >> booking-success.php

create one script namely auth.php with following code

<?php
session_start();
if(!isset($_SESSION['username'])){
    header("location:login.php");
}
?>

In login.php add session

$_SESSION['username'] = $_POST['username'];

Now you can add auth.php in any php page where you want login compulsory as follow :

include ('auth.php');