Magento 1.9 can't add items to shopping cart Form key problem

Question

I have several Magento stores hosted on bluehost. They had been running well for a couple of months and then suddenly one day the customers just could not add products to the shopping cart any more. The store just shows Shopping Cart is Empty.

After days digging into the code, finally I found out the problem caused by FORM_KEY. The form_key that server side fetches stays the same for one session, but the form_key on front side changes every time I refresh the page. So the form_key passed from front end form is different from the one server uses to validate.

The _validateFormKey() in addAction() function always returns false and the items cannot be added to shopping cart.

I tried to block caching by adding the following meta tags to each page, but it did not solve the problem.

meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate"

meta http-equiv="Pragma" content="no-cache"

meta http-equiv="Expires" content="0"

Any ideas?

Answer 1

Maybe you have some problem with cookies, please try to clear the value of web/cookie/cookie_domain and web/cookie/cookie_path, Make also sure that webserver user has right to write to session storage. checking session_save_path setting if you save session to files. It looks like this:

<session_save><![CDATA[files]]></session_save>
<session_save_path><![CDATA[/tmp/session]]></session_save_path>

Answer 2

first off I should mention that we fixed this issue but our stores/setups are maybe not the same.

We had upgraded from Magento 1.7 to 1.9.2.4. The store was running fine. But then we got reports of this issue. We found out about form-keys in Add to Cart and how they were introduced in Magento 1.8. Then we found out that Nexcess_Turpentine 0.6.0 can't handle form-keys. We did find that hitting Flush Magento Cache in Cache mgmt. kind of helped some of the time but couldn't help all visitors. Finally we caught a clue and upgraded to Nexcess_Turpentine 0.7.0. It was 100% Smooth sailing for 3 weeks - then the issue came back.

Our current setup: Varnish 3, Nexcess_Turpentine 0.7.0, Magento 1.9.2.4 on a dedicated server.

Back when I first found out about this problem I was able to temporarily fix the issue by having a cron job flush Varnish ESI Blocks. So the issue was definitely being caused by the initial form-key stored in the cached blocks and Magento generating a new form-key which invalidated the initial key. Eventually we had the cron going off every 20 minutes(not recommended by the way). But customers were still seeing empty carts. We had a Varnish expert check and recheck and check again and they could not find anything wrong. Nobody knew why.

I think that is enough backstory! On to the thing that helped us!

Make a note of the time entered in System > Configuration > General > Web > Session Cookie Management for Cookie Lifetime.

If you have a phpinfo.php on the server look for session.gc_maxlifetime and make a note of that value. The point is to get Cookie Lifetime and session.gc_maxlifetime to be the same values. For example if Cookie Lifetime = 3600, then session.gc_maxlifetime should be 3600.

I simply asked our webhost to make that change in PHP and we have not encountered the issue since.

All credit to https://github.com/nexcess/magento-turpentine/issues/1274