Magento 2 security key issue in Third-Party API redirect URI

Question

I am working on a Instagram extension for magento 2x. When i turn off

"Add Secret Key to URLs" to No

than everything fine and Instagram redirect successfully to my Auth Controller But when

"Add Secret Key to URLs" is Yes

Than it redirect to Dashboard because there is no session key in redirect URI. How can i handle this situation for Magento 2x?

Answer 1

It's not entirely clear where Instagram is getting the URL from for the redirect. But assuming you are doing something along the lines of OAuth and providing a redirect_uri parameter, so long as you generate the redirect_uri you pass correctly (e.g. with $this->getUrl() in a Backend controller), it should include the secret key and thus avoid the problem. If there is some kind of callback to the site from Instagram (as opposed to the customer being redirected) then that's a different problem.

• Sohan: @perter i am not using OAuth, i am using CURL with instagram developer App, in the App i mention redirect URI for my Auth Controller, without session key it works but problem is if session key enabled in magento and i try any url without key it redirect at dashboard. hope it clear to you?

Answer 2

You can use the below variable in your admin controller.

/**
 * Array of actions which can be processed without secret key validation
 *
 * @var array
 */
protected $_publicActions = ['action_name'];