title: Is it possible to allow access to a page only through redirection?
body: <p>I'm working on an application using Spring Boot and Thymeleaf.</p>
  
  <p>I have the following snippet in my custom login page:</p>
  
  <pre><code>&lt;p th:if="${param.logout}"&gt;Logged out successfully&lt;/p&gt;
  </code></pre>
  
  <p>This paragraph is associated with the following security config:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .antMatchers("/", "*.css").permitAll()
              .antMatchers("/myendpoint").authenticated()
              .and()
              .formLogin().loginPage("/login").permitAll()
              .and()
              .logout()
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/login?logout")
                  .permitAll();
  }
  </code></pre>
  
  <p>So after a logout the user is redirected to <code>/login?logout</code> and the logout message is shown.</p>
  
  <p>My problem is this message is also shown when the user explicitly navigates to <code>/login?logout</code> by simply writing <code>http://myserver:8080/login?logout</code> into the browser.</p>
  
  <p>Is it possible to prevent the user from directly accessing <code>/login?logout</code> (and thus show the message only when an actual logout happens)?</p>