Adding permissions and access checks in routesfor Drupal 8 , 9 , 10 , and 11

Having established the basics of setting up both static and dynamic URL paths for your Drupal module, it’s time to focus on securing these routes. In this lesson, we'll delve into adding permissions and access checks to your routes. This crucial step ensures that only authorized users can access specific functionality, protecting sensitive operations and data.

Understanding Permissions and Access Checks

Permissions in Drupal are fine-grained settings that control which users can perform certain tasks. Access checks are the mechanisms that enforce these permissions at the route level. They are vital for maintaining security and ensuring users only access functionality intended for their role.

Embedding permissions into your routing system helps define roles and responsibilities within your site, offering tailored access to different user groups, such as content editors versus general site visitors.

Defining Permissions in a Custom Module

Before using permissions in routes, they need to be defined in a .permissions.yml file within your module:

Create a hello_world.permissions.yml file in your module directory:

access hello world content:
  title: 'Access Hello World content'
  description: 'Grants access to view Hello World content.'
        

• Key: access hello world content is the machine name for the permission, to be used for reference in the route requirements.
• Title and Description: These assist site administrators in understanding what access the permission grants.

Implementing Access Checks in Routes

Once you've defined permissions, implement them within your route configurations in the .routing.yml file:

Example with Access Checks

hello_world.content:
  path: '/hello'
  defaults:
    _controller: '\Drupal\hello_world\Controller\HelloWorldController::content'
    _title: 'Hello World'
  requirements:
    _permission: 'access hello world content'
        

This setup ensures access to the /hello route is restricted to users with the access hello world content permission, delineating specific user access.

Access Checking for Dynamic Routes

For dynamic routes, the process remains similar, with access checks ensuring only authorized users can input parameters and access specific content:

hello_world.dynamic:
  path: '/hello/{name}'
  defaults:
    _controller: '\Drupal\hello_world\Controller\HelloWorldController::dynamicContent'
    _title: 'Personalized Hello'
  requirements:
    _permission: 'access hello world content'
    name: '[a-zA-Z]+'
        

The access check applies before variable data is handled, maintaining security for both static and dynamic route elements.

Testing Permissions and Access Control

After implementing access checks, verify their effectiveness through testing:

1. Assign Permissions: Navigate to People > Permissions on the admin panel and assign the newly defined permission to a user role, such as 'authenticated user'.
2. Test User Access: Log in as a user with the permission and access the route. Confirm access is granted and the content displays correctly.
3. Test Unauthorized Access: Attempt to access the route with a user lacking the permission, ensuring access is denied and you receive an appropriate message.

These steps test your permission systems, ensuring proper access control is enforced and functioning as expected.

Conclusion

Adding permissions and access checks to your routes secures your Drupal application, tailoring access according to user roles and protecting sensitive data and operations. Effective permissions structure enhances both security and user experience by restricting content access to relevant parties only.

Our next lesson will focus on Using dynamic parameters in route paths, further exploring how to capture and utilize user inputs within your application’s routes. Stay tuned as we continue to expand your capabilities in Drupal module development!