I see this line of code inside the login form. <?php echo $block->getBlockHtml('formkey'); ?>

  • What is the use of it?
  • Is it more secure?
  • Is it a must for form post?

Form keys in Magento are a means of preventing against Cross Site Request Forgery, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you.

This can be dangerous because someone could theoretically create their own form and post to any form handler controller action in your store. CSRF protection essentially ignores any post which fail a check on the included form_key parameter with the form post.

<?php echo $this->getBlockHtml('formkey')?>

It tells Magento to look for a layout block with the name "formkey" and output it. In Magento this is usually some file which has this in it:

<div><input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /></div>

This instructs Magento to output and store a unique form key for a user session. All CSRF-protected Magento controller actions will verify against this before doing anything of value.

  • 1
    `<?php echo Mage::getSingleton('core/session')->getFormKey() ?> this will auto generate the form key? I just need to echo the formkey in a form and Magento will take care all the checking?
    – Paul
    Aug 13 '16 at 3:32
  • yes magento will take care
    – Arjun
    Aug 13 '16 at 4:14
  • what is possible situation when form key doesn't match? When customer session expire or something? Of course I mean situation apart cross site request forgery. Dec 5 '16 at 20:43
  • 1
    @Arjun wrote in a comment above that Magento will take care of checking the formKey. This is only true for built-in controllers. If you are creating your own controller, or if it's a third-party controller that doesn't expect the form key, then this is not true. In these cases you need to check it yourself using \Magento\Framework\Data\Form\FormKey\Validator. Aug 1 '17 at 21:15
  • 4
    @Arjun this answer is misleading. the tag refers to magento 2 yet you have given an example for magento 1
    – theSeeker
    Aug 7 '18 at 13:55

You can add formkey by this code:

$objectManager = \Magento\Framework\App\ObjectManager::getInstance(); 
$FormKey = $objectManager->get('Magento\Framework\Data\Form\FormKey'); 
//Hidden form key field after <form> tag
<input name="form_key" type="hidden" value="<?php echo $FormKey->getFormKey();?>">

If you want to add form key in phtml file then use direct


<input name="form_key" type="hidden" value="<?php echo $block->getFormKey();?>">

Using Dependency Injection in your class constructor:

protected $formKey;

public function __construct(
    \Magento\Framework\Data\Form\FormKey $formKey
) {
    $this->formKey = $formKey;

public function getFormKey()
     return $this->formKey->getFormKey();

Note: Don't use object manager directly in phtml files

  • 1
    nice solutions.. Sep 19 '17 at 12:58
  • 3
    Stop suggesting ObjectManager use in frontend this is not a good practice .
    – Vlad Patru
    Jul 4 '18 at 8:04
  • 1
    @PrincePatel You shoud put a disclaimer like that, a new developer would not know this and will set in phtml and from the code sample in the question looks like it needs to be used in phtml
    – Vlad Patru
    Jul 4 '18 at 11:10
  • 1
    Don't use ObjectManager ever! Aug 8 '18 at 13:01
  • 1
    @jafarpinjar Yes it's a coding standard and It defeats the purpose of dependency injection Check this thread for more info: magento.stackexchange.com/questions/117098/… Feb 11 '19 at 6:09

There is no need of initialising object manager and all, you can do it in two ways

  1. By using below javscript statement in your phtml view file.


  2. By calling core block class getKey method in your phtml template file:


Hope this helps!


  • 2
    This is only available in the backend
    – Alex Dinca
    Mar 13 '18 at 20:42
  • Not sure about it, But I have updated the answer for front-end as well. Oct 10 '18 at 7:59
  • elaborate your answer Dec 6 '20 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.