Add to cart url returns invalid url

Question

My add to cart url returns this. When i click it the products doesn't get added because it's invalid. This happens in the homepage.

http://localhost/mage/index.php/checkout/cart/add/uenc/aHR0cDovL2xvY2FsaG9zdC9tYWdlL2luZGV4LnBocC9wYWNrYWdlcy9wYWNrYWdlL2luZGV4Lw`,,`/product/13/form_key/D5FhQaqwv69PjG8q/

First in my code it was using $this->getAddToCartUrl($_product) because of this issue i replaced it with this Mage::helper('checkout/cart')->getAddUrl($_product) Still the problem exists.

If i clear my cache it works for a few hours and again it returns the incorrect url. How can i overcome this problem?

====update=========

Heard that this is a problem with new formkey introduced after magento 1.8. Any solution to overcome this issue?

Answer 1

As someone noted in the comments, the problem is that the form key is being cached. This means every visitor gets the same form key which means the form key won't validate because form keys are only valid in the session in which they were issued. This also explains why it works at first after clearing the cache because the form key is valid in the first session that requests the page/block.

Do not disable form key validation, it is there as a security measure to protect your site from CSRF attacks.

The correct solution is to prevent the form key from being cached.

The best way is to use layout XML to call the setCacheLifetime method on the block that your are outputting and set the cache lifetime to null. For example, for a block named product.new you would use this in your local.xml:

<reference name="product.new">
    <action method="setCacheLifetime" />
</reference>

This sets the cache_lifetime to null for the product.new block. It is important to set it to null and not zero or false:

null = no caching
0 / false = cache forever
>1 = cache for x seconds

Answer 2

The problem is that the formkey is beeing cached and is delivered later to a visitor who is not associated to this formkey. Adding to cart doesn't work then.

The easiest but not that good solution is to disable the formkey security feature. You can find the setting in the backend:

System -> Configuration -> System -> CSRF protection -> Add Secret Key To Url -> No

Otherwise you can disable the formkey validation only for the add to cart method. Just overwrite the method _validateFormKey in the Mage_Checkout_CartController and let it return true.