Drupal 8 Module Development

Entity access in routes

Now that we understand how entity level access control works, let's return to routes for a moment. If you remember, I mentioned the _entity_access route requirement and how we would talk about it once we had covered entity access.

The _entity_access route requirement is nothing more than a service-based access checker, much like the one we wrote ourselves. However, it is created by the entity system in order to control access to routes based on dynamic entity parameters in those routes. Let's see a quick example of a route definition that can use the _entity_access requirement:

products.view_product: path: '/our-products/{product}' defaults: _controller: '\Drupal\products\Controller\ProductsController::showProduct' ...