Hi there,
I’m currently working on a click-based browsergame in my spare time.
To access any pages besides the login or registration view the suer must have logged in.
Therefore I have a Navigator with a ViewChangeListener which sends the user back to the login view, if he tries to access any other page via the menu.
Which means, that every time the code calls navigateTo everything works fine.
But i also need the listener to be triggered when a user enteres a url to a view which he isn’t allowd to enter if he’s not logged in.
I thought the person in thsi topic did face the same problem, but the solution is what I already use.
When debugging my application the method beforeViewChange is not called when typing in a url with a uri fragment to a page.
I tried to reproduce your problem and I get the beforeViewChange event even though I type the view name manually to the URL. Have you made sure, that your ViewChangeListener is certainly added to the navigator at the point when the navigation occurs? Basically, you should register the listener in your UI’s init method and not, for example, when the user logs in.
A few best practices regarding security
Don’t register your views to the navigator until the user has logged in. This way the user won’t be able to navigate to views he doesn’t have access to until he has logged in. You can instantiate the navigator immediately and add the login view, but there is nothing that dictates that you would have to register all views immediately. This same rule also applies if you have views that some logged in users can access and some that can’t - don’t register a view to the navigator unless the user has access rights to open it.
Make sure your views’ constructors are empty. The ViewChangeEvent contains an instance of the view the user is trying to navigate to, in other words, the view class will be instantiated even though you deny access to the view. You can build your view the first time the enter() method is being called.
Thank you a lot.
With your suggestions I didn’t even need the listener anymore, I used an ErrorProvider which navigated to my LoginView, when a user tried to access a View, that wasn’t avaible without login.
So I did as you said, registered the views with restricted access only after the user logged in and deregistered them after he logged out.
And also the problem with the listener might have been caused by not empty constructors (2).