After changing domains, from dev.mysite.com to mysite.com I can no longer login to the backend, I am getting below error:

Invalid Form Key. Please refresh the page.

Also, Customers cannot sign in and products cannot be added to bags.

These are all issues with the form_key, but I have no idea where to even start looking for answers, the system.log only shows:

Warning: strlen() expects parameter 1 to be string, array given in app/code/core/Mage/Catalog/Model/Layer/Filter/Attribute.php on line 93

This Post suggested to double check cookie_domain, and to increase max_input_vars in php.ini but neither of these had any affect. I have also tried using a fresh .htaccess file

Additional info: I have two sites on this Magento installation (everything worked fine before domain change) and the domains simply changed like so:

dev.site1.com -> site1.com

dev.site2.com -> site2.com

And yes I refreshed cache and session data and restarted apache and mysql after every single change.

  • can you try re-indexes or url rewrite?
    – Ajay Patel
    Apr 1, 2016 at 4:36
  • @Ajaypatel Can you be specific? What file am I editing?
    – Gary Frey
    Apr 1, 2016 at 4:38

2 Answers 2


The method that solved my problem included two main things:

I had to fix my cookie domain

http://site1.com -> .site1.com

http://site2.com -> .site2.com

Step #2 was the weirdest

I had to go to my old login panel:


(yes the dns for the subdomain still pointed to the same ip)

and then I was able to login just fine and it actually redirected me correctly to


I will continue to look into why I needed to do this

  • don't forget to clear your browser's cookies and cache. If you use FQDN with an SSL, add www before your cookie domain. This also comes in handy when setting up a staging area with another subdomain (e.g. staging)
    – Steven J
    Jan 19, 2018 at 16:45

There's a number of different issues that cause the errorless admin login behavior you're seeing, but they all go back to Magento not being able to set or read the session cookie. Magento uses sessions to pass error messages between pages — that's why you don't see an error message. Magento also uses sessions to store the "is logged in" value, so not setting sessions also causes the core error behavior.

Possible causes include

  • Local computer time vs. server time mismatch, causing instant cookie invalidation. Make sure your server time is correct.

  • Incorrect permissions on var/session, preventing session files from being saved

  • Incorrect configuration of database/redis/other session storage, preventing saving of session values

  • A module is instantiating sessions to early, preventing the correct session names from being set

  • You're a developer using multiple URLs and have multiple cookie domains

  • Another developer has somehow modified app\code\core\Mage\Core\Model\Session\Abstract\Varien.php, creating a hard to track down bug

  • The cookie domain in System -> Configuration -> Web -> Session Cookie Management doesn't match the actual site domain.

  • You're using the localhost as your server domain, and using a version of webkit that has trouble/bugs setting cookies for localhost in some situations.

The short term fix is to just delete your cookie for the domain. That's often enough to solve the problem. If it persists, figure out which of the above reasons is the reason for your error, and take steps to address it (fix permissions, etc.)


Enable debugging in your site to see error

1.Open your Magento installation directory. Locate and open index.php file. And find


#ini_set('display_errors', 1);

Replace above code form below code:


ini_set('display_errors', 1);

6.Save this file and upload to the server. Reload your website page to see errors.

For more detail see here

  • I don't see /*error_reporting(E_ALL | E_STRICT);*/ in my index.php but I did uncomment the # sign from ini_set('display_errors', 1); and add $_SERVER['MAGE_IS_DEVELOPER_MODE'] = true; and nothing changed, nothing new in system log either. Just says "Invalid Form Key. Please refresh the page."
    – Gary Frey
    Apr 1, 2016 at 5:04
  • I have updated the code plz check
    – Arunendra
    Apr 1, 2016 at 5:10
  • How do I "just delete your cookie for the domain" ? none of the other issues solved the problem
    – Gary Frey
    Apr 1, 2016 at 5:27
  • Have you check permissions on var/session ??
    – Arunendra
    Apr 1, 2016 at 5:28
  • yes they are all completely open (777)
    – Gary Frey
    Apr 1, 2016 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.