I just downloaded and installed the Full Release of Magento Community - ver, but I can't login in backend and frontend.

The error message is:

    Invalid Form Key. Please refresh the page.

I tried to clean the cache and sessions files of magento and of my browser, but doesn't work.

Other things:

  • The file dont exist: app/code/local/Mage/Core/Model/Session.php
  • The correct permissions was setup
  • The form have keys for form_key
  • On the frontend after login, i'm redirected for some page to ENABLE cookies.
  • Table core_config_data dont have values for web/secure, web/unsecure, cookie_path and others, i create myself: core_config_data

Can someone help me?

  • Are you on localhost? – electroid Sep 10 '16 at 14:36
  • No! I'm in a Digital Ocean droplet running on NGINX, VARNISH – user2925795 Sep 10 '16 at 14:37
  • Please check your var/ folder is writable by the server, you can set it 777 permissions and check. Also folder must be owned by the web server user, for example www-data. – electroid Sep 10 '16 at 14:41
  • I try set 777 but yet doesnt work. All files and folders owned by www-data (configured in nginx) with right permissions. – user2925795 Sep 10 '16 at 14:52
  • Since you are on nginx make sure you have that line in your config location \~\.php$ { fastcgi_param PHP_VALUE "session.auto_start=0"; #... more come here but I'm shortening just for the specific problem } – electroid Sep 10 '16 at 15:04

clear your browser cache and cookies,

and after that delete the var/cache and var/session folder and try again login and let me know if you face this issue

  • Same problem, man. "Invalid Form Key. Please refresh the page." – user2925795 Sep 10 '16 at 14:10

you have to add form key in your login form add this input tag

<"input type='hidden' name='form_key' value="<?php echo Mage:getSingleton('core/session')->getFormKey(); ?>" />

in you form

refresh cache delete cache and session folder from var

  • I had tried it. Nothing)): – user2925795 Sep 12 '16 at 13:36
  • firstly you install magento in local. if it works fine than you upload file in server. – Jigs Parmar Sep 14 '16 at 3:24

Check the file app/etc/local.xml and find lines


try to change it to


and then clean caches.

If it will not help - delete app/etc/local.xml file and reinstall magento from scratch. While installation - use your database name (as it's already installed) and installation will be quick.

  • I tried all but doesn't work. (including new installation) – user2925795 Sep 12 '16 at 13:36
  • So this can mean that Form Key is wrongly written to or readed from Session. Can you show session params in app/etc/local.xml ? is it saving session in files (/var/session) ? If so - you can try to switch session to DB - to check if it's exactly the problem. – Neklo.com Sep 13 '16 at 12:14
  • Other session options are Memcache and Redis. If some of them are used - maybe issue is somewhere in server configuration. I have problems with login/cookies sometimes too, but not with message "Invalid form key" and then I'm deleting Cookie Domain and Cookie Path in core_config_data table. Maybe it will help you somehow too – Neklo.com Sep 13 '16 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.