app.get('/protected-page', (req, res) => {
  // 检查请求来源或特定条件
  if (req.headers['x-requested-with'] !== 'XMLHttpRequest' || req.method !== 'GET') {
    return res.status(403).send('Direct GET access not allowed');
  }
  // 正常处理逻辑
  res.send('Protected content');
});

<?php
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    header('HTTP/1.0 403 Forbidden');
    die('Direct GET access not allowed');
}
// 继续处理POST请求
?>

public class BlockGetRequestsMiddleware
{
    private readonly RequestDelegate _next;

    public BlockGetRequestsMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        if (context.Request.Method == "GET" && 
            context.Request.Path.StartsWithSegments("/protected"))
        {
            context.Response.StatusCode = 405; // Method Not Allowed
            await context.Response.WriteAsync("GET method not supported");
            return;
        }
        await _next(context);
    }
}

// 检查如果是直接访问则重定向
if (window.performance.navigation.type === 1) { // 1表示直接输入URL访问
    window.location.href = '/error'; // 重定向到错误页面
}

location /protected/ {
    if ($request_method = GET) {
        return 403;
    }
    # 其他配置
}