our provider has patch our Magento 1.7.02 version today. After this the login from users doesn't work anymore.

After sent username and passwort the fields are empty but nothing changes

Any idea?

5 Answers 5


Try to add that in your customer login form

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />
  • @Andreas Can you make my answer as solved please? Commented Oct 17, 2016 at 19:38
  • This is solving the problem but you should use the commonly used idiom for adding formkeys: <?php echo $this->getBlockHtml('formkey'); ?>
    – fheyer
    Commented Jul 3, 2017 at 7:00

You most likely have to update your custom template files with the changes that this patch introduced to base templates. Files updated include:

M       app/design/frontend/base/default/template/checkout/cart.phtml
M       app/design/frontend/base/default/template/checkout/onepage/review/info.phtml
M       app/design/frontend/base/default/template/wishlist/view.phtml
M       app/design/frontend/base/default/template/sales/reorder/sidebar.phtml
M       app/design/frontend/base/default/template/tag/customer/view.phtml
M       app/design/frontend/base/default/template/persistent/customer/form/login.phtml
M       app/design/frontend/base/default/template/customer/form/login.phtml
M       app/design/frontend/base/default/template/review/form.phtml
M       app/design/frontend/base/default/template/catalog/product/view.phtml

If your local template overwrites any of these files, they need to be updated accordingly.

Most often this will be adding a piece of code to each form:

<?php echo $this->getBlockHtml('formkey'); ?>

but not only. You have to check each file for differences.


A little late but we found the problem in patch SUPEE-8788 V2 which at least applies to the patch files for Magento and Probably this also applies to all prior versions for which a patch version exists. Magento versions from 1.8 on are not affected as the patch doesn't change templates for those.

In detail

The patch is missing a formkey for file app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml

Without it login doesn't work on onepage checkout (it just doesn't work without error).


A formkey has to be inserted like in following patch:

diff --git a/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml b/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
index 9d15a577b..18483a3c5 100644
--- a/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
+++ b/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
@@ -71,6 +71,7 @@
         <h3><?php echo $this->__('Login') ?></h3>
         <?php echo $this->getMessagesBlock()->getGroupedHtml() ?>
         <form id="login-form" action="<?php echo $this->getPostAction() ?>" method="post">
+        <?php echo $this->getBlockHtml('formkey'); ?>
             <h4><?php echo $this->__('Already registered?') ?></h4>
             <p><?php echo $this->__('Please log in below:') ?></p>

Make sure you update all of your template files that @affirmative mention and add just after the beginning of the form tag <form ....><?php echo $this->getBlockHtml('formkey'); ?>

The new patch introduced a if statement for all of the post methods that check's if a formkey was send with the submitted form

 * Submit new review action
public function postAction()
    if (!$this->_validateFormKey()) {
        // returns to the product item page

if no formkey is send the controller will redirect you back to the page without any errors.


Make sure, that your cookie_lifetime is not 0!

Magento is killing session if the cookie_lifetime is over and this is not interpreted the same way as the set cookie.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.