I am checking in admin panel and want to know the importance of "Security Key" which is present into

System > Configuration > Admin >  Add Secret Key to URLs

What is the drawback if this field is set to "No". Is any big problem occurs on Admin Panel. Please let me know about this feature in admin panel.

Actually i am working on custom module in which email functionality is used. In email i send different different urls of admin panels like Manage Products , Manage Orders etc. When admin click on above urls then it opens again dashboard ( if admin is login ). I searched and find about this feature.If this value set to "No" then my links works perfectly.


In Magento Admin new secret key is generated every time you login. It is a unique key 32 Characters long for each session of your Magento admin login. This key is appended to the admin URL as http://test_admin/key/78c1c0a77f2336c0b2dec9ac934af968/ this is only for the security reason

This option is necessary to prevent against CSRF attacks

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf[1]) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts.[2] Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser

I recommend to leave this option enabled.

|improve this answer|||||
  • But according to your link it say for set "No" value for fast admin. – Mathew Oct 30 '15 at 5:26
  • sorry wrongly i update that check now – Magento 2 Oct 30 '15 at 5:29
  • I want this feature for my module functionality.Kindly check my updated question. – Mathew Oct 30 '15 at 5:40
  • This enable option for security reason to prevent CSRF Attacks if you don't want you disable – Magento 2 Oct 30 '15 at 5:42
  • The last place you want a successful XSRF attack is on the Admin of your store. Bad on the front end for customers, they might buy something they didn't want, bad on the backend for you, somebody else owns your store and makes all your customers buy something they didn't want. – Fiasco Labs Oct 30 '15 at 17:44

A new secret key is created every time you login to Magento Admin. So, there will be a unique key (32 chars long) for each session of your Magento admin login

Please see more details : http://blog.chapagain.com.np/magento-how-to-disable-remove-secret-key-from-admin-url/

|improve this answer|||||
  • I want drawback if this value set to "No". – Mathew Oct 30 '15 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.