1

I have a button on front-end category pages for editing these pages. On click it redirects to dashboard rather than category edit form in admin side.

$objectManager = \Magento\Framework\App\ObjectManager::getInstance();
$category = $objectManager->get( 'Magento\Framework\Registry' )->registry( 'current_category' );
$id = $category->getId();
$pageUrl = $this->_backendHelper->getUrl( 'catalog/category/edit', ['id'=>$id] );
1
  • Hi! That functionality should clearly be avoided. It's unsafe to use backend formkey in your frontend actions. The other issue could show up when using full page caching, which will lead you to custom admin blocks cached by FPC on front, which then will l need some kind of cache hole punch functionality to implement, which finally will give you performance issues in the end. Nowadays the FPC is more then needed when using Magento 2 to get it perform functional at least... Maybe to workaround, implement completely new admin area related views to mimic frontend behaviour?
    – dudzio
    Commented Jun 1, 2021 at 18:46

1 Answer 1

0

When secret keys are enabled on the admin, the key is generated using the _form_key value stored in the admin session for the current user. The reason this can not be used to generate valid backend urls from the frontend is that the frontend _form_key is stored in a different session, tied to a different cookie.

The getUrl() method of Magento\Backend\Model\URL calls getSecretKey(), which uses the getFormKey() method of Magento\Framework\Data\Form\FormKey to return the current form key for use as a salt to create the secret key. getFormKey() returns the _form_key stored in the session relevant to the current context, with no way to specify frontend or backend.

The result is that the secret keys generated by your frontend code are based on frontend form keys, and will not validate when checked against the admin form key.

Generating admin URLs on the frontend will also expose your admin URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.