Routing in CodeIgniter 4: explicit routes and Improved Auto Routing

The router maps an URL and HTTP method to a controller. Explicit routes make accessible actions visible; Improved Auto Routing is an alternative that needs deliberate configuration. These examples follow recent documentation: check your installed CodeIgniter release before applying them.

Define explicit routes

Add routes to the existing $routes object in app/Config/Routes.php. Import Products, use GET for reading and POST for creation. (:num) captures a numeric segment and passes it to show. The three routes form a consistent example; adapt names and permissions to your application.

<?php
// app/Config/Routes.php
use App\Controllers\Products;

$routes->get('products', [Products::class, 'index']);
$routes->get('products/(:num)', [Products::class, 'show']);
$routes->post('products', [Products::class, 'create']);

Create the controller

Create app/Controllers/Products.php with the App\Controllers namespace. Public methods mapped by the routes return responses; the protected helperMethod is not an exposed action. The sample returns placeholder data: add input validation, persistence and access control before creating real resources.

<?php
// app/Controllers/Products.php
namespace App\Controllers;

class Products extends BaseController
{
    public function index(): string
    {
        return 'Products';
    }

    public function show(int $id): string
    {
        return 'Product ' . $id;
    }

    public function create()
    {
        return $this->response->setStatusCode(201)->setJSON(['created' => true]);
    }

    protected function helperMethod(): void
    {
        // Internal logic.
    }
}

Secure the actions

Use GET to read and POST to change data. Protect sensitive actions with authentication and authorization, validate input and configure CSRF protection for forms as appropriate. Defining a route alone does not secure its controller.

Improved Auto Routing as an alternative

If you select Improved Auto Routing, set $autoRoute=true in app/Config/Routing.php and $autoRoutesImproved=true in app/Config/Feature.php. Reachable methods carry an HTTP verb prefix, such as getHello() for GET /hello-world/hello in a HelloWorld controller. The default route to Home::index can prevent automatic routing at the root: remove it if / must be automatically resolved. The snippets below belong to separate files and illustrate an alternative mode; check precedence before combining it with the explicit example.

// app/Config/Routing.php
public bool $autoRoute = true;

// app/Config/Feature.php
public bool $autoRoutesImproved = true;

// Example auto-routed method: GET /hello-world/hello
public function getHello(): string { return 'Hello'; }

Names, segments and limits

Automatic URL segment to controller and method matching follows the installed release’s rules. Prefer explicit routes for stable public URLs or precise HTTP method and filter controls. Avoid accidentally exposing public methods or administrative actions.

Inspect the routes

Run php spark routes to inspect registered routes, then test allowed and forbidden GET and POST requests. Check 404/405 responses, route order and filters. Dynamically discovered routes need not appear among explicitly registered routes.

php spark routes

Official references

Routing: https://codeigniter4.github.io/CodeIgniter4/incoming/routing.html ; Improved Auto Routing: https://codeigniter4.github.io/CodeIgniter4/incoming/auto_routing_improved.html ; controllers: https://codeigniter4.github.io/CodeIgniter4/incoming/controllers.html .