I just downloaded and installed the Full Release of Magento Community - ver, but I can't login in backend and frontend.

The error message is:

    Invalid Form Key. Please refresh the page.

I tried to clean the cache and sessions files of magento and of my browser, but doesn't work.

Other things:

  • The file dont exist: app/code/local/Mage/Core/Model/Session.php
  • The correct permissions was setup
  • The form have keys for form_key
  • On the frontend after login, i'm redirected for some page to ENABLE cookies.
  • Table core_config_data dont have values for web/secure, web/unsecure, cookie_path and others, i create myself: core_config_data

Can someone help me?

  • Are you on localhost?
    – electroid
    Commented Sep 10, 2016 at 14:36
  • No! I'm in a Digital Ocean droplet running on NGINX, VARNISH Commented Sep 10, 2016 at 14:37
  • Please check your var/ folder is writable by the server, you can set it 777 permissions and check. Also folder must be owned by the web server user, for example www-data.
    – electroid
    Commented Sep 10, 2016 at 14:41
  • I try set 777 but yet doesnt work. All files and folders owned by www-data (configured in nginx) with right permissions. Commented Sep 10, 2016 at 14:52
  • Since you are on nginx make sure you have that line in your config location \~\.php$ { fastcgi_param PHP_VALUE "session.auto_start=0"; #... more come here but I'm shortening just for the specific problem }
    – electroid
    Commented Sep 10, 2016 at 15:04

3 Answers 3


clear your browser cache and cookies,

and after that delete the var/cache and var/session folder and try again login and let me know if you face this issue

  • Same problem, man. "Invalid Form Key. Please refresh the page." Commented Sep 10, 2016 at 14:10

you have to add form key in your login form add this input tag

<"input type='hidden' name='form_key' value="<?php echo Mage:getSingleton('core/session')->getFormKey(); ?>" />

in you form

refresh cache delete cache and session folder from var

  • I had tried it. Nothing)): Commented Sep 12, 2016 at 13:36
  • firstly you install magento in local. if it works fine than you upload file in server. Commented Sep 14, 2016 at 3:24

Check the file app/etc/local.xml and find lines


try to change it to


and then clean caches.

If it will not help - delete app/etc/local.xml file and reinstall magento from scratch. While installation - use your database name (as it's already installed) and installation will be quick.

  • I tried all but doesn't work. (including new installation) Commented Sep 12, 2016 at 13:36
  • So this can mean that Form Key is wrongly written to or readed from Session. Can you show session params in app/etc/local.xml ? is it saving session in files (/var/session) ? If so - you can try to switch session to DB - to check if it's exactly the problem.
    – Neklo.com
    Commented Sep 13, 2016 at 12:14
  • Other session options are Memcache and Redis. If some of them are used - maybe issue is somewhere in server configuration. I have problems with login/cookies sometimes too, but not with message "Invalid form key" and then I'm deleting Cookie Domain and Cookie Path in core_config_data table. Maybe it will help you somehow too
    – Neklo.com
    Commented Sep 13, 2016 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.