I have below files


I would like to set module wise login permission.

If user is logged in then only they are able to access above pages otherwise redirected to homepage.

I have below code to check, but i have to put in each & every file.

$objectManager = \Magento\Framework\App\ObjectManager::getInstance();
$customerSession = $objectManager->get('Magento\Customer\Model\Session');
if($customerSession->isLoggedIn()) {
   // customer login action

Can we manage this login permission through XML file or any better way?

  • 5
    I think we should use controller_action_predispatch. Read more: magento.stackexchange.com/questions/131706/… Commented Sep 1, 2016 at 8:38
  • We can't set on XML file level? Like this File path will be called after login only? So we have to just define file path or module
    – Jackson
    Commented Sep 1, 2016 at 9:30
  • P.S. Never use the ObjectManager directly, use Dependency Injection in your controller to get the objects you need. See my answer...
    – 7ochem
    Commented Sep 1, 2016 at 10:12
  • @MikeSmith we should check the login permission all time. So, we can use the observer event. Commented Sep 1, 2016 at 16:38
  • @7ochem I didn't get not directly use ObjectManager. Suppose in one file Block/Controller/Any file. If i will use more than 1 ObjectManager then what will be effect? Speed? Please explain the right solution. Not Clear to me
    – Jackson
    Commented Sep 2, 2016 at 6:19

1 Answer 1


You could use a Request Validator.

Your Request Validator is a class that is validating the request and returns a controller result. The magic happens at !$this->session->isLoggedIn():

namespace Custom\Module\Model\Action;

use Magento\Customer\Model\Session;
use Magento\Framework\Controller\ResultFactory;

class RequestValidator
    protected $resultFactory;
    protected $session;

     * @param ResultFactory $resultFactory
     * @param Session $session
    public function __construct(
        ResultFactory $resultFactory,
        Session $session
    ) {
        $this->resultFactory = $resultFactory;
        $this->session = $session;

     * Get validator result
     * @param RequestInterface $request
     * @return \Magento\Framework\Controller\Result\Redirect|null
    public function getResult(RequestInterface $request)
        $result = null;
        if (!$this->session->isLoggedIn()) {
            /** @var $result \Magento\Framework\Controller\Result\Redirect */
            $result = $this->resultFactory->create(ResultFactory::TYPE_REDIRECT);
        return $result;

On top of every one of your controller's execute() methods you add a call to the request validator's getResult() method:

namespace Custom\Module\Controller\MyModule;

use Magento\Framework\App\Action\Action;
use Magento\Framework\App\Action\Context;
use Magento\Framework\App\RequestInterface;
use Custom\Module\Model\Action\RequestValidator;

class NewAction extends Action

    protected $requestValidator;

     * @param Context $context
     * @param RequestValidator $requestValidator
    public function __construct(
        Context $context,
        RequestValidator $requestValidator
    ) {
        $this->requestValidator = $requestValidator;

    // ...

    public function execute()
        $result = $this->requestValidator->getResult($this->getRequest());
        if ($result) {
            // There is a result, which means the customer is not logged in
            return $result;

        // ... Do the stuff when customer is logged in ...

    // ...

Not the answer you're looking for? Browse other questions tagged or ask your own question.