i created a button in the order/view page in magento2 backend, and would like to call a controller when button in clicked.

In my module, I added : etc/adminhtml/routes.xml

<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="adminhtml">
        <route frontName="xstateupdate" id="xstateupdate">
            <module name="My_Module"/>



namespace My\Module\Controller\Xstateupdate;

class Index extends \Magento\Framework\App\Action\Action {

    public function execute()
Breakpoint on something;


In order to check if my controller was working, I manually entered the url : www.xxx.com/admin_toto/admin/xstateupdate/xstateupdate/index.php But it reloads magento backend page and does not trigger my breakpoint...

Thank you for your help

3 Answers 3


When attempting to access modules/functionality in the backend (Adminhtml), Magento checks for the presence of the secret Form Keys, and if/when someone does attempt to access an action and doesn't supply a valid FormKey and/or supplies an Invalid FormKey - the Adminhtml AbstractAction (Magento\Backend\App\AbstractAction) will route the user Admin UIX defined Startup page (which is usually the Dashboard page) [ This mechanism serves a "security checkpoint" to prevent users from accessing portions of the Backend that they don't have access to ]

To prevent the check for FormKey you have essentially have two options available to you:

(a) Disable Secret Key Validation checks

Navigation: Stores -> Settings : Configuration -> Advanced : Admin -> Security -> Setup "Add Secret Key to URLs" to "No"

It's important to remember that doing so will turn off Secret Key Validation, and therefore may make your application vulnerable.

(b) Turn off Secret Key Validation for your controller

Specify the action(s) you wish to exempt, from the FormKey check, in the "$_publicActions" attribute of your Admin Controller. The syntax to define the attribute is as follows:

protected $_publicActions = ['ENTER_NAME_OF_ACTION'];


class Index extends \Magento\Backend\App\Action
    protected $_publicActions = ['index'];

    public function execute()
        echo "My Hello World! Controller";


Hope this helps! :)


You have to create controller directory under Adminhtml directory. Like: My\Module\Controller\Adminhtml\Xstateupdate\Index.php

  • Thank you for your answer. I changed the path as you told me, changed the namespace of Index.php accordingly, recompiled but same result...
    – Alexglvr
    Apr 7, 2017 at 9:34

For anyone reading this. I had the same problem. After too much time of debugging I found the solution.

You cannot enter the url in the backend directly. Either add a menu link to the controller or add a button with uiComponents.

Reason was, the key in the url will be different when you access it via button or link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.