Backend Security key broken for controllers with frontname not equal to route ID

[AlexandreKhayrullin]

Preconditions

The Magento used is the "develop" branch.
PHP: PHP 7.0.10-1+deb.sury.org~xenial+1

Steps to reproduce

1. Create a new module with a controller usable in the backend.
2. Define a new route for the controller (new adminhtml/routes.xml file) with a frontname different from the route ID.
3. Add the new controller to the menu and add the appropriate item to the ACL.
4. Log into the backend, locate the new item and click on it.

Expected result

1. The new controller is executed.

Actual result

1. The user is redirected back to the dashboard.

After a debugging session, it appears that the security key is incorrectly generated during either the creation of backend URLs or the security key validation.

If you place a breakpoint at the last line of \Magento\Backend\Model\Url::getSecretKey(), you'll notice the following discrepancy:

• While generating the security key used during the creation of the URL, the "$secret" string (the one that is hashed to form the security key) starts with the frontname.
• While checking the security key after having clicked on the link, the "$secret" string starts with the route ID instead.

[flancer64]

These are stack traces and secret sources for hashing in my case (Magento ver. 2.2.0-rc30).

Secret key generation for navigation links:

Secret key validation on route action:

My module's descriptors for routes & menu:

./etc/adminhtml/routes.xml

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="admin">

        <route id="fl32_login_as_route" frontName="loginas">
            <module name="Flancer32_LoginAs"/>
        </route>

    </router>
</config>

./etc/adminhtml/menu.xml

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Backend:etc/menu.xsd">
    <menu>
        <add id="Flancer32_LoginAs::customer_logged"
                module="Flancer32_LoginAs"
                action="loginas/logged"/>
    </menu>
</config>

[magento-engcom-team]

@AlexandreKhayrullin, thank you for your report.
We've created internal ticket(s) MAGETWO-81949 to track progress on the issue.