# Add to cart url returns invalid url

My add to cart url returns this. When i click it the products doesn't get added because it's invalid. This happens in the homepage.

http://localhost/mage/index.php/checkout/cart/add/uenc/aHR0cDovL2xvY2FsaG9zdC9tYWdlL2luZGV4LnBocC9wYWNrYWdlcy9wYWNrYWdlL2luZGV4Lw,,/product/13/form_key/D5FhQaqwv69PjG8q/


First in my code it was using $this->getAddToCartUrl($_product) because of this issue i replaced it with this Mage::helper('checkout/cart')->getAddUrl(\$_product) Still the problem exists.

If i clear my cache it works for a few hours and again it returns the incorrect url. How can i overcome this problem?

====update=========

Heard that this is a problem with new formkey introduced after magento 1.8. Any solution to overcome this issue?

• If it works several hours without cache - probably it should work always. But if you are using some Ful Page Cache - you have to create some cache Hole to fix the issue. – Neklo.com May 17 '16 at 9:19
• Will you be able to provide a link to a post to create the necessary cache hole ? – Lakshin Karunaratne May 17 '16 at 9:56

As someone noted in the comments, the problem is that the form key is being cached. This means every visitor gets the same form key which means the form key won't validate because form keys are only valid in the session in which they were issued. This also explains why it works at first after clearing the cache because the form key is valid in the first session that requests the page/block.

Do not disable form key validation, it is there as a security measure to protect your site from CSRF attacks.

The correct solution is to prevent the form key from being cached.

The best way is to use layout XML to call the setCacheLifetime method on the block that your are outputting and set the cache lifetime to null. For example, for a block named product.new you would use this in your local.xml:

<reference name="product.new">
</reference>


This sets the cache_lifetime to null for the product.new block. It is important to set it to null and not zero or false:

null = no caching
0 / false = cache forever
>1 = cache for x seconds

The problem is that the formkey is beeing cached and is delivered later to a visitor who is not associated to this formkey. Adding to cart doesn't work then.

The easiest but not that good solution is to disable the formkey security feature. You can find the setting in the backend:

System -> Configuration -> System -> CSRF protection -> Add Secret Key To Url -> No


Otherwise you can disable the formkey validation only for the add to cart method. Just overwrite the method _validateFormKey in the Mage_Checkout_CartController and let it return true.

• This disabled only the key in the admin backend. in the front end it was still there. – Lakshin Karunaratne May 17 '16 at 17:48
• my fault sorry, I've updated the config path: System -> Configuration -> System -> CSRF protection -> Add Secret Key To Url -> No – Detzler May 18 '16 at 9:25
• Until i find a better solution i'll stick with this. Thanks – Lakshin Karunaratne May 18 '16 at 16:35
• do not disable a security feature like this as a workaround for a problem that is easy to fix properly – BlueC Jun 14 '19 at 8:27