I am currently having issues with frontend forms where the form keys are somehow being overwritten and displaying incorrect form keys. I am currently debugging this issue on the customer login form.

This is snapshot of the code at login.phtml, that i setup to see what the formkey value is.

      $retrievedKey =  $block->getBlockHtml('formkey');
      echo $retrievedKey ;
      // i made a breakpoint and inspected $retrievedKey, it returned a html output <input> ... </input> with a form key value of, let's name it 'keyA'.

ok so now after i continued the code execution, it renders the page successfully.

And now i go to inspect the form key hidden input on my chrome browser, however, it prints out a totally different form key from 'KeyA'. Let's name this new form key 'KeyB'.

Now i try and do a login, and submit the form. I inspected the request that is sent over, and it indeed passes a form key variable of value that reflects 'KeyB'.

I have placed some breakpoints at 'validate' function of


This is my comparison checker. By right, $formKey and $a should match. However, it does not.

 $formKey = $request->getParam('form_key', null); // outputs 'KeyB'
 $a = $this->_formKey->getFormKey(); // outputs 'KeyA'

Thus, the validation fails, and it redirects me back to the login page with no error message what so ever.

Things to note:

  1. This behavior only arises in chrome and Microsoft EDGE.
  2. Firefox works fine, no overwriting is happening
  3. The form key that is printed out seems to be changing on each refresh. $retrievedKey doesn't refresh each time though

Things i have tried:

  1. setup:upgrade and setup:static-content:deploy
  2. cleared var/cache and var/generation
  3. cleared browser cache and incognito mode

I just can't my head around why the form-key is being overwritten?

Any help or hints on why this is happening would be great. Thanks for reading

Update - I've done some debugging and i figured that page-cache.js is causing the issue by setting the form key again. This is due to the fact that, it is checking my cookies if a 'form_key' cookie is set, if not, create a new form key and save to cookies. The problem is, it is not able to save the cookie, that is why it keeps creating new form keys.

Update - I have solved the issue. This is due to cookie domain issues. Thanks

  • Thanks a lot for documenting a fix. Spent some time debugging the issue seeing the same behavior - form key is generated again and again on the front-end
    – Paras Sood
    Commented Dec 30, 2017 at 13:31
  • 1
    In my case it was the magento system cache, as it was migrated from a staging env. Store -> Settings -> Confguration -> System -> Full Page Cache -> Caching Application: Set to Built-in Cache (if not sure whether varnish is up or not). Commented May 31, 2018 at 2:15
  • Having the exact same problem and was looking at the form keys in validation as well. You said this was due to cookie domain issues, can you share how you fixed that? Thanks Commented Sep 6, 2018 at 19:11

2 Answers 2


For my case, I am using localhost in URL so the following solution helps me.

If you are using localhost in your URL in the local computer, so then replace it with IP.

I mean if your URL is


replace it with

Hope it will work for Chrome & Edge and Firefox also.


I've just spent the best part of a day trying to figure out why Magento's JS couldn't read my form_key cookie.

In my case it was because I had Apache configured to always force cookies to be HttpOnly - which javascript libraries simply cannot read. Disabling HttpOnly in my Apache config sorted this (note this is different to the HttpOnly option in Magento admin, which appears to leave the form_key cookie alone even when set to 'Yes').

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.