When my users click on a one-time-password-reset link then I log them in and then show them a page where they can choose their new password. Problem is that there are two additional links on that page (one for dashboard and some other one) and they can click on them and visit the linked pages.
I want that until they change their password they cannot navigate to other pages. For now I managed to set a custom value in $_SESSION, but I can’t figure out how I can intercept their further request (once they land on password change page). How can I check for such a session value and redirect them back to password-reset page (if they haven’t changed their password yet) and allow them to navigate to other pages only after they changed their password?
