My add to cart url returns this. When i click it the products doesn't get added because it's invalid. This happens in the homepage.


First in my code it was using $this->getAddToCartUrl($_product) because of this issue i replaced it with this Mage::helper('checkout/cart')->getAddUrl($_product) Still the problem exists.

If i clear my cache it works for a few hours and again it returns the incorrect url. How can i overcome this problem?


Heard that this is a problem with new formkey introduced after magento 1.8. Any solution to overcome this issue?

  • If it works several hours without cache - probably it should work always. But if you are using some Ful Page Cache - you have to create some cache Hole to fix the issue.
    – Neklo.com
    Commented May 17, 2016 at 9:19
  • Will you be able to provide a link to a post to create the necessary cache hole ? Commented May 17, 2016 at 9:56

2 Answers 2


As someone noted in the comments, the problem is that the form key is being cached. This means every visitor gets the same form key which means the form key won't validate because form keys are only valid in the session in which they were issued. This also explains why it works at first after clearing the cache because the form key is valid in the first session that requests the page/block.

Do not disable form key validation, it is there as a security measure to protect your site from CSRF attacks.

The correct solution is to prevent the form key from being cached.

The best way is to use layout XML to call the setCacheLifetime method on the block that your are outputting and set the cache lifetime to null. For example, for a block named product.new you would use this in your local.xml:

<reference name="product.new">
    <action method="setCacheLifetime" />

This sets the cache_lifetime to null for the product.new block. It is important to set it to null and not zero or false:

null = no caching
0 / false = cache forever
>1 = cache for x seconds


The problem is that the formkey is beeing cached and is delivered later to a visitor who is not associated to this formkey. Adding to cart doesn't work then.

The easiest but not that good solution is to disable the formkey security feature. You can find the setting in the backend:

System -> Configuration -> System -> CSRF protection -> Add Secret Key To Url -> No

Otherwise you can disable the formkey validation only for the add to cart method. Just overwrite the method _validateFormKey in the Mage_Checkout_CartController and let it return true.

  • This disabled only the key in the admin backend. in the front end it was still there. Commented May 17, 2016 at 17:48
  • my fault sorry, I've updated the config path: System -> Configuration -> System -> CSRF protection -> Add Secret Key To Url -> No
    – Detzler
    Commented May 18, 2016 at 9:25
  • Until i find a better solution i'll stick with this. Thanks Commented May 18, 2016 at 16:35
  • do not disable a security feature like this as a workaround for a problem that is easy to fix properly
    – BlueC
    Commented Jun 14, 2019 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.