12

I see this line of code inside the login form. <?php echo $block->getBlockHtml('formkey'); ?>

  • What is the use of it?
  • Is it more secure?
  • Is it a must for form post?
18

Form keys in Magento are a means of preventing against Cross Site Request Forgery, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you.

This can be dangerous because someone could theoretically create their own form and post to any form handler controller action in your store. CSRF protection essentially ignores any post which fail a check on the included form_key parameter with the form post.

<?php echo $this->getBlockHtml('formkey')?>

It tells Magento to look for a layout block with the name "formkey" and output it. In Magento this is usually some file which has this in it:

<div><input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /></div>

This instructs Magento to output and store a unique form key for a user session. All CSRF-protected Magento controller actions will verify against this before doing anything of value.

  • 1
    `<?php echo Mage::getSingleton('core/session')->getFormKey() ?> this will auto generate the form key? I just need to echo the formkey in a form and Magento will take care all the checking? – Paul Aug 13 '16 at 3:32
  • yes magento will take care – Arjun Aug 13 '16 at 4:14
  • what is possible situation when form key doesn't match? When customer session expire or something? Of course I mean situation apart cross site request forgery. – Bartosz Kubicki Dec 5 '16 at 20:43
  • 1
    @Arjun wrote in a comment above that Magento will take care of checking the formKey. This is only true for built-in controllers. If you are creating your own controller, or if it's a third-party controller that doesn't expect the form key, then this is not true. In these cases you need to check it yourself using \Magento\Framework\Data\Form\FormKey\Validator. – Scott Buchanan Aug 1 '17 at 21:15
  • 4
    @Arjun this answer is misleading. the tag refers to magento 2 yet you have given an example for magento 1 – theSeeker Aug 7 '18 at 13:55
17

You can add formkey by this code:

<?php 
$objectManager = \Magento\Framework\App\ObjectManager::getInstance(); 
$FormKey = $objectManager->get('Magento\Framework\Data\Form\FormKey'); 
?>
//Hidden form key field after <form> tag
<input name="form_key" type="hidden" value="<?php echo $FormKey->getFormKey();?>">

If you want to add form key in phtml file then use direct

$this->getFormKey()

<input name="form_key" type="hidden" value="<?php echo $block->getFormKey();?>">

By Factory Method

protected $formKey;

public function __construct(
    ...
    \Magento\Framework\Data\Form\FormKey $formKey
    ...
) {
    $this->formKey = $forKey
}

public function getFormKey()
{
     return $this->formKey->getFormKey();
}

Note: Don't use object manager directly in phtml files

  • 1
    nice solutions.. – Rakesh Jesadiya Sep 19 '17 at 12:58
  • 1
    Stop suggesting ObjectManager use in frontend this is not a good practice . – Vlad Patru Jul 4 '18 at 8:04
  • @VladPatru yes is it. Don't use object manager directly in phtml files. This is just an example to get formKey you should do with the factory method. Check my updated answer – Prince Patel Jul 4 '18 at 8:49
  • @PrincePatel You shoud put a disclaimer like that, a new developer would not know this and will set in phtml and from the code sample in the question looks like it needs to be used in phtml – Vlad Patru Jul 4 '18 at 11:10
  • @VladPatru Thanks for the suggestion. I added a note in my answer. – Prince Patel Jul 4 '18 at 12:11
-1

There is no need of initialising object manager and all, you can use.

window.FORM_KEY

Frontend you can use:

$block->getKey()

Hope this helps!

Thanks

  • 2
    This is only available in the backend – Alex Dinca Mar 13 '18 at 20:42
  • Not sure about it, But I have updated the answer for front-end as well. – kapil yadav Oct 10 '18 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.