Java Play Framework Hidden Url Routes

Is it possible to hide/mask the urls in the java play framework. The problem I have come across is I want a user to be able to log in and view messages belonging to them but I do not want any old user to find theses messages by simply hacking the url.

What I have got is a Notifications controller which has a method called show(long id).

my route for this method is:

GET     /Message/Show               Notifications.show

i call the function using

@Notifications.show(':id')

the url for this function is:

http://localhost:9000/Message/Show?id=8

Is it poss开发者_Python百科ible to remove the parameter off the end of the url so people can not hack into certain urls by guessing parameters.

---

This is something that can be achieved with Interceptions.

http://www.playframework.org/documentation/1.2.3/controllers#interceptions

Inside these classes you can check if the current user is logged in (store in session)

---

If I got this right, you want to hide URLs so users don't know them and do not enter them. If they do, they would see content they shouldn't see. This is bad and should not be done this way, take a look at Security through obscurity (Wikipedia), use readable/bookmarkable URLs and build proper login and security mechanisms like leifg suggested.

---

This is the approach I used, I do not know if this is the best way around this but it does work how I want it to.

Thanks for all the help and ideas.

public static void show(long id)
    {
        Notification notification = Notification.findById(id);
        User connectedUser = User.find("byEmail", Security.connected()).first();

        if(notification.recipient.equals(connectedUser))
        {
            render(notification);
        }
        else
        {
            forbidden("This isnt your message stop hacking the urls!");     
        }
    }

---

Or you could log in the user and fetch only the users message.

Why search a complicate solution such as obfuscation/interceptions and whatever when a very simple solution exists. Use the session of the connected user, fetch only his messages and done.