Is it possible to create an admin route that doesn't need the admin "key" in the URL?

Question

I created a new admin route and hooked it up to one of the admin menus for testing. When I click the menu link I go to a URL like this:

http://localhost/magento/index.php/myroute/adminhtml_index/index/key/4dee0c78dec3bc0ff3cf3f3166970602/

Is it possible to create an admin URL/route that doesn't require that key in the URL?

Answer 1

In Magento Admin new secret key is generated every time you login.

It is a unique key 32 Characters long for each session of your Magento admin login. This key is appended to the admin URL as http://test_admin/key/78c1c0a77f2336c0b2dec9ac934af968/ this is only for the security reason

This option is necessary to prevent against CSRF attacks

---

Sometime you may want to access admin URL without the secret key. For this, you can disable the secret key from admin URL.

Here is how you do it:-

---

Go to System -> Configuration -> ADVANCED -> Admin -> Security -> Add Secret Key to URLs

• – Select No
• – Save Config

Answer 2

There is also the possibility to add actions which does not require the secret key. See: https://www.magento1-shop.com/index.php/admin/sales_order/view/order_id/1/

class Mage_Adminhtml_Sales_OrderController extends Mage_Adminhtml_Controller_Action
{
    /**
     * Array of actions which can be processed without secret key validation
     *
     * @var array
     */
    protected $_publicActions = array('view', 'index');

    public function viewAction()
    {...}
}