Magento 2 - Invalid security or form key. Please refresh the page

Question

I have recently upgraded from 2.3.7 to 2.4.3 and since the upgrade I am seeing

"Invalid security or form key. Please refresh the page."

on every page in admin. (frontend works fine)

Most things in the backend still work even with the error present apart from the ability to add products to a manual order in the backend. I have disabled all 3rd party modules and set max_input_vars to 200000 but it doesn't solve the error.

I have cleared all caches and removed all generated code etc and also run setup:upgrade. I have also checked to ensure cookie path and domain are valid. But still the error shows! Anyone have any other ideas? Or how I can debug further? Thanks.

Answer 1

I found this in the error logs:

main.WARNING: Session size of 271329 exceeded allowed session max size of 256000

Setting the max_session_size_admin to unlimited resolved the issue:

php bin/magento config:set system/security/max_session_size_admin 0

Answer 2

This is a newly introduced issue in 2.4.3.

You need to make changes described here, to ger rid of this message: https://github.com/magento/magento2/issues/33749#issuecomment-908145941

The file is found in: \vendor\magento\module-backend\App\Action\Plugin\Authentication.php

Good Luck,

Answer 3

You should check the cookie setting Stores > Configuration > General > Web Default Cookie Settings > Cookie Domain