0

PATCH_SUPEE-8788 introduced form_keys for the form on catalog_product_view, and the Cart Controller checks if they are valid. So far so good, but our shop uses the Lesti_FPC full page cache extension and a varnish cache, so the form_keys on the product form never fit to the ones in the session so our customers can't add products to their carts if we fully implement SUPEE-8788.

For now we've implemented the patch without form_key validation in the Cart Controller.

Is there a best practice for using form_keys and full page caches or varnish? Is there anything bad that can be done if there is no form key validation in the cart controller other than adding random products to someones cart?

1

3 years ago Gordon (Author of Lest_Fpc) created a fix for the form_key:
https://github.com/GordonLesti/Lesti_Fpc/commit/e3725928fcac1924ed663c33bd4067e99b3e7eb1

So, you can use <!-- fpc form_key_placeholder --> as Placeholder and it will be automaticly replaced with the correct form_key

  • That solves Lesti, but unfortunately not varnish. – disappointed.moose Oct 14 '16 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.