PATCH_SUPEE-8788 introduced form_keys for the form on catalog_product_view, and the Cart Controller checks if they are valid. So far so good, but our shop uses the Lesti_FPC full page cache extension and a varnish cache, so the form_keys on the product form never fit to the ones in the session so our customers can't add products to their carts if we fully implement SUPEE-8788.

For now we've implemented the patch without form_key validation in the Cart Controller.

Is there a best practice for using form_keys and full page caches or varnish? Is there anything bad that can be done if there is no form key validation in the cart controller other than adding random products to someones cart?


1 Answer 1


3 years ago Gordon (Author of Lest_Fpc) created a fix for the form_key:

So, you can use <!-- fpc form_key_placeholder --> as Placeholder and it will be automaticly replaced with the correct form_key

  • That solves Lesti, but unfortunately not varnish. Commented Oct 14, 2016 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.