Admin Routes

routes.xml for Admin Area

<!-- app/code/Vendor/Module/etc/adminhtml/routes.xml -->
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="admin">
        <route id="vendor_module" frontName="vendor_module">
            <module name="Vendor_Module" before="Magento_Backend"/>
        </route>
    </router>
</config>

Front Name Structure

// URL structure: /admin/vendor_module/controller/action
// Example: /admin/vendor_module/order/view

// Front name: vendor_module
// Controller: order
// Action: view

// Full URL: https://magento.com/admin/vendor_module/order/view/id/123

URL Builder

namespace Vendor\Module\Url;

class AdminUrlBuilder
{
    public function __construct(
        private \Magento\Backend\Model\UrlInterface $backendUrlBuilder
    ) {}

    public function getAdminUrl(string $route, array $params = []): string
    {
        return $this->backendUrlBuilder->getUrl($route, $params);
    }
}

// Usage
$url = $this->adminUrlBuilder->getUrl('vendor_module/order/view', ['id' => 123]);
// Returns: http://magento.com/admin/vendor_module/order/view/id/123/

URL in Controllers

namespace Vendor\Module\Controller\Adminhtml\Order;

class View extends \Magento\Backend\App\Action
{
    public function execute()
    {
        $orderId = $this->getRequest()->getParam('id');

        // Generate URL for redirect
        $url = $this->_url->getUrl('vendor_module/order/index');

        return $this->_redirect('vendor_module/order/view', ['id' => $orderId]);
    }
}

Admin Route Security

// Check if request is from admin area
if ($this->_backendSession->isLoggedIn()) {
    // User is logged into admin
}

// Validate admin session
$session = $this->authSession;
if (!$session->isLoggedIn()) {
    return $this->_redirect('adminhtml/account/login');
}

ACL Check in Route

// ACL configuration in etc/acl.xml
<config>
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <resource id="Magento_Backend::stores">
                    <resource id="Magento_Backend::stores_settings">
                        <resource id="Magento_Config::config"/>
                    </resource>
                </resource>
                <resource id="Magento_Sales::sales">
                    <resource id="Magento_Sales::orders"/>
                </resource>
            </resource>
        </resources>
    </acl>
</config>

Route Middleware

// Custom route middleware
namespace Vendor\Module\Controller\Adminhtml\Plugin;

class RoutePlugin
{
    public function beforeExecute(
        \Magento\Backend\App\Action $action
    ): void {
        // Pre-execution checks
        if (!$this->isAllowed($action)) {
            throw new \Magento\Framework\Exception\AuthorizationException(
                __('Access denied.')
            );
        }
    }
}

Admin URL Settings

<!-- app/code/Vendor/Module/etc/config.xml -->
<config>
    <default>
        <web>
            <default>
                <frontName>admin</frontName>
            </default>
        </web>
    </default>
</config>

Custom Admin Front Name

// Change admin URL for security
// bin/magento setup:config:set --backend-frontname="myadmin"

// Or in env.php:
return [
    'backend' => [
        'frontName' => 'myadmin',
    ],
];

URL Rewrite for Admin

// Custom URL rewrite for admin routes
namespace Vendor\Module\Rewrite;

class AdminUrlRewrite
{
    public function __construct(
        private \Magento\UrlRewrite\Model\UrlRewriteInterface $urlRewrite
    ) {}

    public function rewrite(string $url): string
    {
        $rewrite = $this->urlRewrite->rewrite(
            new \Magento\Framework\DataObject(['request_url' => $url])
        );

        return $rewrite->getTargetUrl();
    }
}