title: Access Control
summary: Define allowed behavior and add permission based checks to your Controllers.
# Access Control
Within your controllers you should declare and restrict what people can see and do to ensure that users cannot run
actions on the website they shouldn't be able to.
## Allowed Actions
Any action you define on a controller must be defined in a `$allowed_actions` static array. This prevents users from
directly calling methods that they shouldn't.
:::php
true,
// restrictedaction can only be people with ADMIN privilege
'restrictedaction' => 'ADMIN',
// restricted to uses that have the 'CMS_ACCESS_CMSMain' access
'cmsrestrictedaction' => 'CMS_ACCESS_CMSMain',
// complexaction can only be accessed if $this->canComplexAction() returns true.
'complexaction' => '->canComplexAction',
// complexactioncheck can only be accessed if $this->canComplexAction("MyRestrictedAction", false, 42) is true.
'complexactioncheck' => '->canComplexAction("MyRestrictedAction", false, 42)',
);
}
If the permission check fails, SilverStripe will return a `403` Forbidden HTTP status.
An action named "index" is white listed by default, unless `allowed_actions` is defined as an empty array, or the action
is specifically restricted.
:::php
Access checks on parent classes need to be overwritten via the [Configuration API](../configuration).
## Forms
Form action methods should **not** be included in `$allowed_actions`. However, the form method **should** be included
as an `allowed_action`.
:::php
getVar('apikey')) {
return $this->httpError(403, 'No API key provided');
}
return 'valid';
}
}
This is recommended as an addition for `$allowed_actions`, in order to handle more complex checks, rather than a
replacement.
## Controller Level Checks
After checking for allowed_actions, each controller invokes its `init()` method, which is typically used to set up
common state, If an `init()` method returns a `SS_HTTPResponse` with either a 3xx or 4xx HTTP status code, it'll abort
execution. This behavior can be used to implement permission checks.
`init` is called for any possible action on the controller and before any specific method such as `index`.
:::php
httpError(403);
}
}
}
## Related Documentation
* [Security](../security)
## API Documentation
* [api:Controller]