2

I created a new admin route and hooked it up to one of the admin menus for testing. When I click the menu link I go to a URL like this:

http://localhost/magento/index.php/myroute/adminhtml_index/index/key/4dee0c78dec3bc0ff3cf3f3166970602/

Is it possible to create an admin URL/route that doesn't require that key in the URL?

3
  • do you want to access admin URL without the secret key ? Sep 26, 2018 at 17:14
  • yes, i want to use an admin URL that doesn't need the secret key. is it possible?
    – Ryan
    Sep 26, 2018 at 19:47
  • If the answer solves your concern then please mark as right, which will help future readers. Sep 28, 2018 at 15:43

2 Answers 2

2

In Magento Admin new secret key is generated every time you login.

It is a unique key 32 Characters long for each session of your Magento admin login. This key is appended to the admin URL as http://test_admin/key/78c1c0a77f2336c0b2dec9ac934af968/ this is only for the security reason

This option is necessary to prevent against CSRF attacks


Sometime you may want to access admin URL without the secret key. For this, you can disable the secret key from admin URL.

Here is how you do it:-


Go to System -> Configuration -> ADVANCED -> Admin -> Security -> Add Secret Key to URLs

  • – Select No
  • – Save Config
0

There is also the possibility to add actions which does not require the secret key. See: https://www.magento1-shop.com/index.php/admin/sales_order/view/order_id/1/

class Mage_Adminhtml_Sales_OrderController extends Mage_Adminhtml_Controller_Action
{
    /**
     * Array of actions which can be processed without secret key validation
     *
     * @var array
     */
    protected $_publicActions = array('view', 'index');

    public function viewAction()
    {...}
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.