Prevent user from navigating through other pages - php

Question

Here's the scenario, I have 2 user which is the Employee and Resident.
The Employee has an account on our website wherein they can see all the Residents' documents and they can select those documents so that the Resident can fill it up.
BTW the Resident doesn't have an account on the website. The only way they can fill up the said documents is by sending an email to them which contains an API or through a device that will be given to them onsite and has a login session of an Employee.
How can I prevent the Resident from navigating through other pages (Go back) once the device is given to them because the Employee cannot always monitor the Resident's action.
Thanks.
Edit: So what I've done previously is I have separate accounts for these users but after thinking thoroughly, an account for the Resident is unnecessary specially when they're too old to use devices. Logging in/out between Resident and Employee just to fill up documents will double up the process.
I'm thinking if it's good to save a session like
$session = $_SESSION['fillUp'];
whenever the Employee picks a document for Resident filling it up, then upon saving the document (which the Employee can only do) the form will then ask for a security code to be input by the Employee so that the document will be saved and unset the session.
Having that session checked on every other page except the document page if it exists will redirect the Resident to the document thus preventing navigation when filling up a document.
// Check session 'fillUp' for every controller except controller sign
public function beforeAction($action)
{
if (Yii::$app->controller->id != 'sign') {
$session = Yii::$app->session;
// session 'fillUp' contains the url of the document to be signed
if ($session->has('fillUp')) {
$this->redirect($session->get('fillUp'));
}
}
}

Answer 1

You will never stop people from using the browser's default navigation options. Whether than be browser back buttons, or swiping to navigate backwards. I've seen people in user experience testing sessions swipe to navigate backward by mistake.
Instead of trying to lock the door, we need to deal with what happens on the previous page(s) should they achieve the back navigation. Let's deal with the posibility that it may happen.
There are two pieces to what you're trying to achieve.
The first is to stop the browser from caching the previous page(s). This means any back navigation will trigger a request to the server to get the information.
We can stop this by adding headers to the page content of sensitive pages:
Send cache control: no-cache, pragma: no-cache and expire: -1 headers.
The second part is to decide what to do if somebody does navigate back, and the server gets a request for that page again.
You certainly want to mark the session as 'resident' on the first hit of the resident page. From there if the session has a 'resident' marker in the session, you may choose to show a warning with a link back to the page they should be visiting, or simply redirect them back to it without intereaction. Personally I think the warning with a link is clearer and will stop confusion.