How is the «Add Secret Key to URLs» backend option implemented and used?

dmitry_fedyuk (Dmitrii Fediuk) May 21, 2016, 10:52pm 1

Implementation

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/etc/adminhtml/system.xml#L380-L384


<field id="use_form_key" translate="label" type="select" sortOrder="10" showInDefault="1" showInWebsite="0" showInStore="0" canRestore="1">
    <label>Add Secret Key to URLs</label>
    <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
    <backend_model>Magento\Config\Model\Config\Backend\Admin\Usesecretkey</backend_model>
</field>

Usages

1. \Magento\Backend\Model\Url.php::XML_PATH_USE_SECURE_KEY

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/Model/Url.php#L16-L21


/**
 * Whether to use a security key in the backend
 *
 * @bug Currently, this constant is slightly misleading: it says "form key", but in fact it is used by URLs, too
 */
const XML_PATH_USE_SECURE_KEY = 'admin/security/use_form_key';

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/Model/Url.php#L259-L267


/**
 * Return secret key settings flag
 *
 * @return bool
 */
public function useSecretKey()
{
    return $this->_scopeConfig->isSetFlag(self::XML_PATH_USE_SECURE_KEY) && !$this->getNoSecret();
}

Details: How is \Magento\Backend\Model\Url::useSecretKey() implemented and used?

2. \Magento\Config\Model\Config\Backend\Admin\Custom::XML_PATH_ADMIN_SECURITY_USEFORMKEY

github.com

magento/magento2/blob/b366da/app/code/Magento/Config/Model/Config/Backend/Admin/Custom.php#L25-L25


const XML_PATH_ADMIN_SECURITY_USEFORMKEY = 'admin/security/use_form_key';

It is never used.

How is \Magento\Backend\Model\Url::useSecretKey() implemented and used?

dmitry_fedyuk (Dmitrii Fediuk) May 21, 2016, 10:53pm 2

See also:

backend-url-secret-key-tagged articles