Anti-refresh (F5) submit form in CodeIgniter - codeigniter

Question

How to prevent refresh form page in CodeIgniter?
If I use redirect — all fine, but I can directly appeal to page site.com/update/success.
How can I prevent direct access to success page (only from site.com/update/) ?
Controller update.php
public function index() {
if($this->form_validation->run() == FALSE) {
$data['error'] = 'Something wrong';
$this->load->view('update', $data);
} else {
redirect('/update/success');
}
}
public function success() {
$message = 'Your profile has been successfully updated';
$this->load->view($message);
}

Answer 1

You could set a token in flashdata in your index() function and then check for that token in your success() method.
class Update extends CI_Controller {
property $token;
public function __construct()
{
$this->load->library('session');
}
public function index() {
if($this->form_validation->run() == FALSE) {
$data['error'] = 'Something wrong';
$this->load->view('update', $data);
} else {
$this->session->set_flashdata('update_token', time());
redirect('/update/success');
}
}
public function success() {
// Make sure this request came from the index() method...
if( ! $this->session->flashdata('update_token'))
{
redirect();
}
$message = 'Your profile has been successfully updated';
$this->load->view($message);
}
}

Answer 2

It's a time ago i used codeigniter so im not sure.
maybe you can make the succes function private and just call it in the else like this:
public function index() {
if($this->form_validation->run() == FALSE) {
$data['error'] = 'Something wrong';
$this->load->view('update', $data);
} else {
$this->success();
}
}
private function success() {
$message = 'Your profile has been successfully updated';
$this->load->view($message);
}

Answer 3

public function index() {
if($this->form_validation->run() == FALSE) {
$data['error'] = 'Something wrong';
$this->load->view('update', $data);
} else {
// create success session/cookie
$this->_success()
}
}
public function _success() {
// destroy success session when called
// checks success session if existing if not the page has been refreshed redirect
$message = 'Your profile has been successfully updated';
echo $this->nocache();
$this->load->view($message);
}
public function _nocache()
{
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
}
YOu can add '_' underscore so that it is not accessible by url, and add a no cache to the headers so that the page will not stay cache on the browser when they click back or access the same url again.
code not tested