We have created a custom permissions that we want to use to prevent unauthorized access to an admin form. Only someone with "administer admin_form" should have access to the page. There is a menu link that was created to allow access to the page.

How can I create a controller that will check if the user has the permission and hide the menu link if the user does not have the permission? If somehow they got access to the menu link path, we would also like to display a message "you do not have access to this page" and hide the form.

We have tried the following:


administer admin_form:
  title: 'Administer admin form'
  description: 'Allows the ability to change settings'
  restrict access: true


  route_name: mymodule.settings
  title: 'My module'
  description: 'some message'
  weight: 99


  path: /admin/config/user-interface/admin-form
    _title: 'My module setting'
    _form: \Drupal\mymodule\form\AdminForm
    _permission: 'administer admin_form'

1 Answer 1


I think you can omit restrict access and remove the _ from your permission name.

Anyway, you have a typo in your permission key. It should be _permission instead of _permissions. See: https://www.drupal.org/docs/8/api/routing-system/introductory-drupal-8-routes-and-controllers-example

Make that change and clear the cache.

  • I just checked and i have the _permission correct in my actual code. For some reason when I pasted I added the s at the end of _permission by accident. However, after making that change to remove restrict access and remove the _, would what I have done suffice? Commented Mar 19, 2018 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.