I have seen that below method.

protected function _isAllowed()
    return $this->_authorization->isAllowed('Custom_Module::moduleslider_banners');
  1. What exactly it will do?
  2. Will it check the user is logged in or not?
  3. When it's called?

Why i'm asking because in my custom Module i'm using this, but when session expire on Admin side & if i'm on my Custom Module Page then it gives below error

Magento 2: Fatal error: Uncaught Error: Call to a member function getId()

When session expire it should automatically redirect to Login page of Admin, but it's not working like that.

3 Answers 3


isAllowed() is used to check if your controller(for specific method) is authorized for logged in user or not.

It by default returns true so you should define it to restrict from user.

As you can see, by default, this method returns true. That means if you don’t define your own _isAllowed method your Admin Panel features will be open to any user with an Admin Panel account, and people using your code will have no way to restrict access to your features


_isAllowed() method is used to check if a “role” has access to a “resource” and a particular “privileged” in that resource. This is mainly used in magento admin to check if admin user has access to a page. The code is implemented in ‘admin/session’ model, which has the isAllowed() method.

The concept remain same in Magento 1 and Magento 2 Magento Access Control Lists


In Magento 2 Controller has one or more files in Controller folder of module, it includes actions of class which contain execute() method. There are 2 different controllers, they are frontend controller and backend controller. They are generally similar of workflow, but admin controller is a little different. There is a checking permission method in admin controller. Let’s take an example:

protected function _isAllowed()
    return $this->_authorization->isAllowed('Magento_AdminNotification::show_list');

It will check the current user has right to access this action or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.