5

I found this 'yes' option is default when I install

Admin - Add Secret Key to URLs - Yes

whenever I use admin, the url seems so complicate due to this option.

e.g.) http://my-domain.com/index.php/mydomain_admin/system_config/edit/section/admin/key/d7b0ccc20349109f7d533de7bea8ff9b/

Using this option have some benefit? is it effect some admin speed performance badly?

Do you recommend to set 'yes' to this option and can I know the reason?

Improve this question
6

This option is necessary to prevent against CSRF attacks:

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf[1]) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts.[2] Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

There is no speed benefit to disabling this option and it opens your store up to potential attack. I recommend to leave this option enabled.

Sources:

http://en.wikipedia.org/wiki/Cross-site_request_forgery

Improve this answer
  • 1
    There is a huge speed benefit to the login process when your cache is large. In 1.7, our cache was multiple gigabytes, and login to the admin timed out repeatedly. I either have to empty the cache before every login, or turn off this "feature." I hope someone finds a solution that preserves security and allows for fast login. See here: code007.ro/magento-admin-login-process-extremely-slow – Buttle Butkus Jun 17 '15 at 2:29
2

Actually, there is a big benefit from disabling - if you are woking in team, it's good idea to disable this feature in development process and enable it back when it goes to production. If this option is enabled you are unable to pass admin links to other coleagues, tickets, chat, etc.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.