Is it i possible to prevent certain PartialViews from being served if requested directly?

Question

I'm working on a site that has routes to actions which render Partial Views. A lot of these partial views are components which together make up a complete page.

For instance on a search page I'm working on has a text box, a list of tabs, and a Table.

Seach of these can be accessed with a URL similar to

/Search/SearchPanel
/Search/Tabs/{SearchTerm}
/Search/ResultsTable/SearchTerm?tab=[currently selected tab]

and these are all rendered on with a RenderPartial on my Index page.

When the page loads, it will display each of these components the way I want it. But at the moment there's nothing stopping a user from going directly to the url

/Search/Tabs

to render only a tab control which is meaningless outside the context of the rest of the elements on the page.

Is there a way for me to prevent this?

Answer 1

Have you tried marking your Controller method as private?

private PartialViewResult MyPartialResultMethod()

This should allow you to call it from within your code to build up your pages and disallow any public access such as through a URl.

I'm testing this now to make doubly sure my answer is correct so I'll update as I test.

In your tabs example you could simply restrict access by using a second controller method for Tabs that's private.

So you'd have something that looks like:

public ActionResult Tabs(string searchTerm) // When a search term is passed.

and

private ActionResult Tabs() // When no search term is passed.

Answer 2

You could create an ActionFilter which checks if the Request.IsAjaxRequest() is true. If it's not (meaning the user is calling the view directly), re-direct accordingly.