I regularly visit my site to make sure its working and noticed that images for products were not appearing, thinking it was a problem with indexing cache I tried to login to the admin panel and received the error:

"invalid form key. please refresh the page"


Other symptoms are customers could not add products to cart and extremely slow performance.

There are no errors in the logs (/var/logs)

What additional steps should I perform to resolve this issue?

11 Answers 11


It also happens if the cookie domain in System > Configuration > Web > Cookies is different from the actual site domain.

To remove the setting without access to the admin panel:

  1. use the following SQL query on the MySQL console or in a client like phpMyAdmin:

    DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain';
  2. clear the cache. If you are using the default file based cache backend, delete all directories below var/cache.

Then as soon as you can log in again, set the correct cookie domain for each website or store (Example: .example.com for example.com, www.example.com and all other subdomains)

If you are using n98-magerun (and you should!), the same can be accomplished with:

n98-magerun config:delete web/cookie/cookie_domain
n98-magerun cache:clean config
  • Hi @fschmengler, please add more details on how to check this setting from phpmyadmin, because user is not able to login to admin panel and some developers who are new to Magento development don't know where to check such settings in database. Sorry, but just for help of new members :) Commented Aug 29, 2016 at 10:00
  • @MohitKumarArora you are right, I updated the answer Commented Aug 29, 2016 at 10:21
  • Now I have upvoted. :) Commented Aug 29, 2016 at 10:27
  • n98 way works fantastic. Thanks for the info.
    – andy jones
    Commented May 3, 2017 at 10:14
  • @FabianSchmengler, I checked the core_config_data and it's the correct value for my site. Do I still need to go through all the steps you provided? Would your approach still work in this case?
    – datasn.io
    Commented Nov 4, 2017 at 3:26

I am posting the question / answer because I couldn't find anything relevant.

The issue was that the drive on which my magento installation resides was full. I freed up some room, clear the /var/session and /var/cache and everything went back to normal.

  • 1
    Warning: deleting var/session will log out everybody and clear all guest carts. See here for a solution that only removes old sessions: magento.stackexchange.com/a/58167/243 Commented Sep 14, 2016 at 11:12
  • @fschmengler yes but do you really want to take a chance with sessions that werent properly created to begin with? When I checked the /var/session there were all kinds of 0kb files which is not normal.
    – SR_Magento
    Commented Sep 14, 2016 at 12:52
  • 1
    Absolutely a first thing to check. Been racking my head on this for hours. Thanks! Commented Apr 6, 2017 at 16:09
  • For me it was disk space. I found out after trying to git pull, as it failed with disk space related error. Commented Apr 27, 2017 at 5:19
  • @SR_Magento Sir I was removed cache folder and session folder so many time it's works only for some time after some time there is an same issue Commented May 30, 2017 at 13:24

There are 3 solutions:

  1. Use these commands in phpmyadmin

    DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain';

    DELETE FROM core_config_data WHERE path='web/cookie/cookie_path';

Now Try to login.

2.Delete everything in var folder and then check if it works.

3.Replace the .htaccess file with sample .htaccess file and then try to login the admin.

Hope it help you.

  • Thank you. It worked.
    – Mohit
    Commented Aug 18, 2021 at 9:46

In my case the problem seems to be because I've created the admin user using n98-magerun with an user that cannot write on magentofolder/var and used the fallback folder /tmp/magento instead.

I just deleted my admin user and executed a sudo -iu OTHERUSER(user that owns the magento folder) and ran n98-magerun admin:user:create again to create my user.

UPDATE: In another case, the admin url has being visited without www. syntax, and the cookie settings was using www. Just putting the www. in the admin url solved the problem. ;)

  • Shouldn't this be admin:user:create?
    – sr9yar
    Commented Nov 21, 2018 at 19:22
  • 1
    @sr9yar nope - that's Magento2 - this is M1
    – treyBake
    Commented Jun 7, 2019 at 11:02

There are two cases of the cookie configuration that could be obstructing the session functionality.

The domain of the cookie does not match, or the protocol (ssl or not) here is what it looks a request where the cookie is set as "secure" but its not using an http ssl url:

enter image description here

to fix them both you just have to run following:

    DELETE FROM core_config_data WHERE path='web/cookie/cookie_secure';
    DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain';

and then clear the cache. for file based cache:

    rm -Rf var/cache/mage--*

for redis:

redis-cli flushall

Another possible, somewhat obvious, problem to check first: if your site uses SSL, make sure you're not using the http protocol for your admin page; you should be using https. e.g. https://example.com/admin


Along with the above step of clearing cache, i also had to follow the below article and set the session data information in correct path by following the below steps

Ref article


I fixed it by changing the session.save_path to place it in the VM.

Change the file app/etc/local.xml

replaced with below

Then it started working. Also at times you cannot really tell the issue, thus it is important you enable error logging. Enable this by referring to following article



Clear cookies and cache. Open admin panel in incognito mode.


I fixed it by

1.Clear browsing data > ctrl+shift+del

2.Clear cookie settings "Sites that should never use cookies" > chrome://settings/cookies

"invalid form key" (chrome browser)


Hi could something explain the solution to this problem without using it language. Honestly you might aswel be speaking a different language. We can all do that about things we know about but it doesn't help people with the problem, just causes further confusion.


This is known issue generally comes after applying patch SUPEE-7405 included in Magento release. It can be solved by adding below code in file - app/code/local/Mage/Core/Model/Session.php

public function validateFormKey()
    if (!($formKey = $_REQUEST['form_key']) || $formKey != $this->getFormKey()) {
        return false;
    return true;

This file might not exist in your repository so copy it from app/code/core/Mage/Core/Model/Session.php and paste it in app/code/local/Mage/Core/Model/Session.php After that add above function in file because it may be missing in core file.

Also clear your browser cache and cookies. Clear all files in Magento var/cache and var/session folders contents. Then login to your admin panel.

  • Ermm..wouldn't a better solution be to add the form key block output to the overridden adminhtml template? (That way the CSRF protection will work as intended). Commented Jan 15, 2017 at 2:47
  • 2
    One should never edit core files.
    – Max
    Commented Oct 24, 2017 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.