18

I have a page that I listed products, that's it. Its kind of catalog/view.phtml clone. Just included app/Mage.php.

In this page I use

Mage::getSingleton('core/session')->getFormKey(); 

but it's different to other page's formKey

What am I doing wrong?

17

Probably nothing because the form key is random, so it has to be different each time.

So it should not make a difference, but the best practice, how you should add the form key input to your template, is this:

<?php echo $this->getBlockHtml('formkey') ?>

Update: I have to admit, I was wrong in one point: The form key stays the same during a session. If you have a different form key on different pages, this might be a problem with a third party full page cache that includes the form key in the cache (which it should not), or the form key is within a custom block that's using block cache. For the latter, I found a solution: Cache blocks that contain form_key (i.e. dynamic content)

  • this suppose to output an hidden input form? but I can't out put it on my review.phtml? any thought? – wlin Jan 14 '15 at 20:08
  • Yes and you should be able to do it in any block on any page. getBlockHtml() is implemented in Mage_Core_Block_Abstract and the formkey block is defined in base/default/layout/core.xml – Fabian Schmengler Jan 15 '15 at 0:24
  • I can't get it to output even in a clean 1.8 instal. but I hardcode this <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>"/> in. Seem to fix it, but still frustrating. is there a better way. – wlin Jan 15 '15 at 0:28
  • 3
    Why should the form key be different each time? It should be the same for a given session on any page; it should only vary by different sessions. – Nick Rolando Jul 9 '15 at 18:58
  • I agree that it is not really necessary but this is how it works in Magento. – Fabian Schmengler Jul 9 '15 at 19:08
8

I know this vague question should not be answered. However I might have run into a similar issue here, this is what I have learned:

  • the form_key must not be different in each request
  • the form_key is consistent throughout the session
  • a different session should create a different form_key (try another browser)
  • the PAGE CACHE does sometimes interfere with this
  • with me this resulted in a Widget showing the same (cached) form_key for all sessions.
    • i don't get this "feature"

Based on short example I therefore have overridden the addtocart checkout action like this in a new Module:

app/code/local/Name/Checkout/controllers/CartController.php

<?php
require_once(Mage::getModuleDir('controllers','Mage_Checkout').DS.'CartController.php');

class Name_Checkout_CartController extends Mage_Checkout_CartController
{
    public function addAction()
    {
        $request = $this->getRequest();
        $formKey = Mage::getSingleton('core/session')->getFormKey();
        $request->setParam('form_key', $formKey);
        return parent::addAction();
    }
}

app/code/local/Name/Checkout/etc/config.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Name_Checkout>
            <version>0.1.0</version>
        </Name_Checkout>
    </modules>
    <frontend> 
        <routers>
            <checkout> 
                <args>
                    <modules>
                        <name_checkout before="Mage_Checkout">Name_Checkout</name_checkout>
                    </modules>
                </args>
            </checkout>>
        </routers>
    </frontend>
</config>

app/etc/modules/Name_Checkout.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Name_Checkout>
            <active>true</active>
            <codePool>local</codePool>
            <depends>
                <Mage_Checkout/>
            </depends>
        </Name_Checkout>
    </modules>
</config>

I hope this will be extensively enough for everyone to recreate this

  • +1 for "the PAGE CACHE does sometimes interfere with this". This is the case for why I cannot add products to wishlist. We are using Varnish page caching, and it is caching the form keys. – Nick Rolando Jul 9 '15 at 19:15
1

Can't comment so I'm answering instead. Don't add the form key in the controller. It disables the security benefits of the form key. If you are using Varnish you can use ESI (Edge Side Includes) to add the key. You'll have to save it in a cookie for that to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.