Skip to main content
added 237 characters in body
Source Link

Vendor_InvalidSecurityFormKeyBugFixAdding a sequence for loading our module after the Magento_Backend module
Vendor_InvalidSecurityFormKeyBugFix/etc/module.xml

And finally the replacement of the method _redirectIfNeededAfterLogin from the github issue https://github.com/magento/magento2/issues/33749#issuecomment-908145941 of the above comment. 
Vendor_InvalidSecurityFormKeyBugFix/App/Action/Plugin/AuthenticationOverride.php

HoptInstall the module and register it in DB

bin/magento setup:upgrade

Now, the error message should not come anymore after login in the backend
Hope this helps and do not forget to remove the bugfix after update to Magento 2.4.4 :-)

Vendor_InvalidSecurityFormKeyBugFix/etc/module.xml

And finally the replacement of the method _redirectIfNeededAfterLogin from the github issue https://github.com/magento/magento2/issues/33749#issuecomment-908145941 of the above comment. Vendor_InvalidSecurityFormKeyBugFix/App/Action/Plugin/AuthenticationOverride.php

Hopt this helps and do not forget to remove the bugfix after update to Magento 2.4.4 :-)

Adding a sequence for loading our module after the Magento_Backend module
Vendor_InvalidSecurityFormKeyBugFix/etc/module.xml

And finally the replacement of the method _redirectIfNeededAfterLogin from the github issue https://github.com/magento/magento2/issues/33749#issuecomment-908145941 of the above comment. 
Vendor_InvalidSecurityFormKeyBugFix/App/Action/Plugin/AuthenticationOverride.php

Install the module and register it in DB

bin/magento setup:upgrade

Now, the error message should not come anymore after login in the backend
Hope this helps and do not forget to remove the bugfix after update to Magento 2.4.4 :-)

Source Link

Since the Magento 2.4.4 update will be released at March 2022 it make sense to create a little bugfix module, here is the code:

Create a basic module nutshell:
Vendor_InvalidSecurityFormKeyBugFix/registration.php

<?php

\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    'Vendor_InvalidSecurityFormKeyBugFix',
    __DIR__
);

Vendor_InvalidSecurityFormKeyBugFix/etc/module.xml

<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Vendor_InvalidSecurityFormKeyBugFix">
        <sequence>
            <module name="Magento_Backend"/>
        </sequence>
    </module>
</config>

Vendor_InvalidSecurityFormKeyBugFix/composer.json

{
  "name": "vendor/invalid-security-form-key-bug-fix",
  "type": "magento2-module",
  "description": "This Module is a bug fix for the error message in the dashboard after login into the backend",
  "minimum-stability": "dev",
  "require": {
    "php": ">=7.3.0"
  },
  "autoload": {
    "files": [
      "registration.php"
    ],
    "psr-4": {
      "Vendor\\InvalidSecurityFormKeyBugFix\\": ""
    }
  }
}

Now adding a di preference for overriding the Authentication.php with our AuthenticationOverride.php
Vendor_InvalidSecurityFormKeyBugFix/etc/di.xml

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Magento\Backend\App\Action\Plugin\Authentication" type="Vendor\InvalidSecurityFormKeyBugFix\App\Action\Plugin\AuthenticationOverride" />
</config>

And finally the replacement of the method _redirectIfNeededAfterLogin from the github issue https://github.com/magento/magento2/issues/33749#issuecomment-908145941 of the above comment. Vendor_InvalidSecurityFormKeyBugFix/App/Action/Plugin/AuthenticationOverride.php

<?php

namespace Vendor\InvalidSecurityFormKeyBugFix\App\Action\Plugin;

use Magento\Framework\Exception\AuthenticationException;

/**
 * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
 */
class AuthenticationOverride
{
    /**
     * @var \Magento\Backend\Model\Auth
     */
    protected $_auth;

    /**
     * @var string[]
     */
    protected $_openActions = [
        'forgotpassword',
        'resetpassword',
        'resetpasswordpost',
        'logout',
        'refresh', // captcha refresh
    ];

    /**
     * @var \Magento\Backend\Model\UrlInterface
     */
    protected $_url;

    /**
     * @var \Magento\Framework\App\ResponseInterface
     */
    protected $_response;

    /**
     * @var \Magento\Framework\App\ActionFlag
     */
    protected $_actionFlag;

    /**
     * @var \Magento\Framework\Message\ManagerInterface
     */
    protected $messageManager;

    /**
     * @var \Magento\Backend\Model\UrlInterface
     */
    protected $backendUrl;

    /**
     * @var \Magento\Backend\App\BackendAppList
     */
    protected $backendAppList;

    /**
     * @var \Magento\Framework\Controller\Result\RedirectFactory
     */
    protected $resultRedirectFactory;

    /**
     * @var \Magento\Framework\Data\Form\FormKey\Validator
     */
    protected $formKeyValidator;

    /**
     * @param \Magento\Backend\Model\Auth $auth
     * @param \Magento\Backend\Model\UrlInterface $url
     * @param \Magento\Framework\App\ResponseInterface $response
     * @param \Magento\Framework\App\ActionFlag $actionFlag
     * @param \Magento\Framework\Message\ManagerInterface $messageManager
     * @param \Magento\Backend\Model\UrlInterface $backendUrl
     * @param \Magento\Framework\Controller\Result\RedirectFactory $resultRedirectFactory
     * @param \Magento\Backend\App\BackendAppList $backendAppList
     * @param \Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
     */
    public function __construct(
        \Magento\Backend\Model\Auth $auth,
        \Magento\Backend\Model\UrlInterface $url,
        \Magento\Framework\App\ResponseInterface $response,
        \Magento\Framework\App\ActionFlag $actionFlag,
        \Magento\Framework\Message\ManagerInterface $messageManager,
        \Magento\Backend\Model\UrlInterface $backendUrl,
        \Magento\Framework\Controller\Result\RedirectFactory $resultRedirectFactory,
        \Magento\Backend\App\BackendAppList $backendAppList,
        \Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
    ) {
        $this->_auth = $auth;
        $this->_url = $url;
        $this->_response = $response;
        $this->_actionFlag = $actionFlag;
        $this->messageManager = $messageManager;
        $this->backendUrl = $backendUrl;
        $this->resultRedirectFactory = $resultRedirectFactory;
        $this->backendAppList = $backendAppList;
        $this->formKeyValidator = $formKeyValidator;
    }

    /**
     * @param \Magento\Backend\App\AbstractAction $subject
     * @param \Closure $proceed
     * @param \Magento\Framework\App\RequestInterface $request
     *
     * @return mixed
     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
     */
    public function aroundDispatch(
        \Magento\Backend\App\AbstractAction $subject,
        \Closure $proceed,
        \Magento\Framework\App\RequestInterface $request
    ) {
        $requestedActionName = $request->getActionName();
        if (in_array($requestedActionName, $this->_openActions)) {
            $request->setDispatched(true);
        } else {
            if ($this->_auth->getUser()) {
                $this->_auth->getUser()->reload();
            }
            if (!$this->_auth->isLoggedIn()) {
                $this->_processNotLoggedInUser($request);
            } else {
                $this->_auth->getAuthStorage()->prolong();

                $backendApp = null;
                if ($request->getParam('app')) {
                    $backendApp = $this->backendAppList->getCurrentApp();
                }

                if ($backendApp) {
                    $resultRedirect = $this->resultRedirectFactory->create();
                    $baseUrl = \Magento\Framework\App\Request\Http::getUrlNoScript($this->backendUrl->getBaseUrl());
                    $baseUrl = $baseUrl . $backendApp->getStartupPage();
                    return $resultRedirect->setUrl($baseUrl);
                }
            }
        }
        $this->_auth->getAuthStorage()->refreshAcl();
        return $proceed($request);
    }

    /**
     * Process not logged in user data
     *
     * @param \Magento\Framework\App\RequestInterface $request
     * @return void
     */
    protected function _processNotLoggedInUser(\Magento\Framework\App\RequestInterface $request)
    {
        $isRedirectNeeded = false;
        if ($request->getPost('login')) {
            if ($this->formKeyValidator->validate($request)) {
                if ($this->_performLogin($request)) {
                    $isRedirectNeeded = $this->_redirectIfNeededAfterLogin($request);
                }
            } else {
                $this->_actionFlag->set('', \Magento\Framework\App\ActionInterface::FLAG_NO_DISPATCH, true);
                $this->_response->setRedirect($this->_url->getCurrentUrl());
                $this->messageManager->addErrorMessage(__('Invalid Form Key. Please refresh the page.'));
                $isRedirectNeeded = true;
            }
        }
        if (!$isRedirectNeeded && !$request->isForwarded()) {
            if ($request->getParam('isIframe')) {
                $request->setForwarded(true)
                    ->setRouteName('adminhtml')
                    ->setControllerName('auth')
                    ->setActionName('deniedIframe')
                    ->setDispatched(false);
            } elseif ($request->getParam('isAjax')) {
                $request->setForwarded(true)
                    ->setRouteName('adminhtml')
                    ->setControllerName('auth')
                    ->setActionName('deniedJson')
                    ->setDispatched(false);
            } else {
                $request->setForwarded(true)
                    ->setRouteName('adminhtml')
                    ->setControllerName('auth')
                    ->setActionName('login')
                    ->setDispatched(false);
            }
        }
    }

    /**
     * Performs login, if user submitted login form
     *
     * @param \Magento\Framework\App\RequestInterface $request
     * @return bool
     */
    protected function _performLogin(\Magento\Framework\App\RequestInterface $request)
    {
        $outputValue = true;
        $postLogin = $request->getPost('login');
        $username = isset($postLogin['username']) ? $postLogin['username'] : '';
        $password = isset($postLogin['password']) ? $postLogin['password'] : '';
        $request->setPostValue('login', null);

        try {
            $this->_auth->login($username, $password);
        } catch (AuthenticationException $e) {
            if (!$request->getParam('messageSent')) {
                $this->messageManager->addErrorMessage($e->getMessage());
                $request->setParam('messageSent', true);
                $outputValue = false;
            }
        }
        return $outputValue;
    }

    /**
     * Checks, whether Magento requires redirection after successful admin login, and redirects user, if needed
     *
     * @param \Magento\Framework\App\RequestInterface $request
     * @return bool
     */
    protected function _redirectIfNeededAfterLogin(\Magento\Framework\App\RequestInterface $request)
    {
        $requestUri = null;

        // Checks, whether secret key is required for admin access or request uri is explicitly set
        if ($this->_url->useSecretKey()) {
            $requestParts = strpos(trim($request->getRequestUri(),'/'), $request->getFrontName()) === 0 ?
                explode('/', trim($request->getRequestUri(), '/'), 4) :
                explode('/', trim($request->getRequestUri(), '/'), 3);
            if (($key = array_search($request->getFrontName(), $requestParts)) !== false) {
                unset($requestParts[$key]);
            }
            $requestParams = $request->getParams();
            unset($requestParams['key'], $requestParams['form_key']);
            $requestUri = $this->_url->getUrl(implode('/', $requestParts), $requestParams);
        } elseif ($request) {
            $requestUri = $request->getRequestUri();
        }

        if (!$requestUri) {
            return false;
        }

        $this->_response->setRedirect($requestUri);
        $this->_actionFlag->set('', \Magento\Framework\App\ActionInterface::FLAG_NO_DISPATCH, true);
        return true;
    }
}

Hopt this helps and do not forget to remove the bugfix after update to Magento 2.4.4 :-)