Error - Invalid Form Key

Question

I meet a problem with magento 1.9.2.3, an error message appears when I connect with my custom admin form.

I created a module and I duplicated the customer/account/login page for my users role.

<?xml version="1.0"?>
<config>
    <modules>
        <Custom_Page>
            <active>true</active>
            <codePool>local</codePool>
        </Custom_Page>
    </modules>
</config>

my config.xml:

<?xml version="1.0"?>
<config>
    <global>
        <page>
            <layouts>
                <Custom_Page>
                    <label>User Login</label>
                    <template>page/user_login.phtml</template>
                </Custom_Page>
            </layouts>
        </page>
    </global>
</config>

No problem with old magento version.

But with 1.9.2.3: The Invalid Form Key. Please refresh the page appears.

NOTE: If I replace the old Observer.php it's done:

www\app\code\core\Mage\Admin\Model\Observer.php

But I think it's not serious to replace the new Observer.php with the old.

EDIT: My user_login.phtml contains an input form_key.

<form action="/admin" method="post" id="login-form">
    <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>"/>

Thanks for your help.

Answer 1

I had the same problem and could fix it by setting the correct

web/cookie/cookie_domain

and

web/cookie/cookie_path

values in the table core_config_data.

Don't forget to clear all session and cookie data in your browser and the Magento session and cache files/data afterwards.

Answer 2

I used these queries and could login again

DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain'; DELETE FROM core_config_data WHERE path='web/cookie/cookie_path';

and please make sure that webserver user has right to write to session storage. checking session_save_path setting if you save session to files. It looks like this

<session_save><![CDATA[files]]></session_save> <session_save_path><![CDATA[/tmp/session]]></session_save_path>

Answer 3

Newer versions of Magento require forms to have <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> to prevent CSRF (Cross-Site Request Forgery) attacks.

Answer 4

Check your settings for https. If you use httpsfor your magento but trying open site with http you will have this a problem.

Answer 5

I got this error after upgrading to php7.0. running magento enterprise 1.9. I then tried every suggestion out there. Here is how I got it to work:

1. I added error reporting in my index.php, and fixed all the errors being reported.

2. In MySQL table core_config_data, I cleared values for web/cookie_path web/cookie_httponly. Make sure you have the right web/cookie_domain value with your domain (very important).

3. Clear your browser cache and cookies.

Answer 6

I had the same error with Magento 1.9.2.3 after copying site on local web server on MAMP 3.

So, problem resolved when I changed in table core_config_data the web/cookie/cookie_domain to mysite.lan instead of the mysite.lan:8888 .

Answer 7

In my case this was working on Linux but on my local windows environment using virtualbox/Docker and windows 10 this error was caused by the weird permissions that vb/docker/windows gives to /var/sessions/. On my local development environment only I moved the path from a mapped windows drive to a "real" path on the linux VM

I added this to the config file app/etc/local.xml, then deleted all files in var/cache and var/session and could login OK.

<session_save><![CDATA[files]]></session_save>
<session_save_path><![CDATA[/tmp]]></session_save_path>

Answer 8

In my case I created the error with this steps: I had moved a magento copy (dev) in the magento itself: magento/magento-copy Before, they where next to each other on the server. Everyone with his own quota. So moving one qutoa into the other -> problems occured. Cause I could not view the magento-copy with FTP I changed the owner of the files by file-editor. For any reason this created the error.

Answer 9

Check if you can login on https://yourwebsite/admin instead http and check core_config_data web/secure/use_in_adminhtml

i've got similar problem and login works only on secure

Answer 10

I often get this problem when I am working on several development sites and live sites, and there is some cookie confusion. Previously I've fixed it with MySQL queries and deleting files but I have found a neater way to solve the problem.

The magerun tool provides a way to check for problems with the cookie path and to fixe them. magerun isn't a part of Magento, so you will need to install it. It is described as a swiss-army-knife for magento, so you could find it useful for other things.

To download it:

wget https://files.magerun.net/n98-magerun.phar

Then

chmod +x n98-magerun.phar

Then check the cookie path for problems...

./n98-magerun.phar config:get web/cookie/*

It will print a table. Look at the value for web/cookie/cookie_domain. When I am having this problem it does not match the proper hostname for the site (e.g. I get dev.example.com instead of www.example.com).

To fix it you need to reset the path and flush the cache, which magerun can help with...

./n98-magerun.phar config:set web/cookie/cookie_domain ""
./n98-magerun.phar cache:flush

You should then be able to log in again.

Answer 11

Regarding the accepted answer ( https://magento.stackexchange.com/a/102678/6078 ) the correct entries are

web/cookie/cookie_domain = your base url like:

https://website.com/ (without any store code)

and

web/cookie/cookie_path

typically just / but can be /[storecode]/ also per store

For local development it usually works to delete cookie_domain or leave it empty but it seems like Microsoft Edge 80 has issues with that.

Answer 12

My problem was php version 7.2 .

change my php version for 5.6 in .htaccess

AddHandler application/x-httpd-php56 .php suPHP_ConfigPath /opt/php56/lib

Answer 13

Another way this error can happen for homemade admin modules is when frontName in your routes.xml doesn't match the <add action"someFrontName/someAction" /> in your menu.xml. This causes the key you see in the link when trying to open the module to be different than expected.

Answer 14

After copying your magento 1 site to a new domain, Varien.php may still have the old domain name in the file.

To ensure your admin form is using the new 'cookie domain, update any references to your old domain in the Varien.php file located in your site at:

/<magento_html_dir>/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

After making the edits, run a cache flush/clean, and reindex all (n98-magerun tool is good for this): Example:

n98-magerun cache:clean
n98-magerun cache:flush
n98-magerun index:reindex:all