My customer is running Magento version After applying the security patches including SUPEE-7405, it's no longer possible to login to the backend because we get the error

"invalid form key. please refresh the page".

That is because of the changes in the method actionPreDispatchAdmin() of the class Mage_Admin_Model_Observer.

I tried to delete all cookies and clean the session folder but it still doesn't work. The weird thing about this is: on the stage system all works fine. The difference between this two systems is the session storage. Stage system uses files, live system uses memcache. I tried to change the live system to files too but it doesn't work neither.

I think the reason the login fails is the fact that I have no adminhtml cookie on the admin login page of the live system. Therefore the comparison (if ($cookie->get(session_name()) == $this->getSessionId()) {) on line 126 of the class Mage_Core_Model_Session_Abstract_Varien fails!

Has anybody of you have an idea why the cookie is not getting created? Even if I try to set the cookie manually in the login-template it does not work. On the stage system I see the cookie.

  • 1
    Did you check web/cookie/cookie_path and web/cookie/cookie_domain settings in core_config_data? – Lord Skeletor Jul 9 '16 at 5:34
  • Yes I did. both is set to NULL/empty... – Marco Becker Jul 10 '16 at 21:16
  • If the adminhtml cookie does not get set, there has to be another difference between the systems, the session storage seems to be irrelevant. Cookie configuration has already been mentioned. It might help to set the cookie domain explicitly to the domain of the live system. If it does not help, I would synchronize file system and database to the staging system and make sure, they are as identical as possible. As soon as you can reproduce the bug outside production it will be easier to debug. – Fabian Schmengler Jul 26 '16 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.