After new magento 1.9 installation when I am login to the admin panel there is a fine flow.

After that if I am opening admin panel on other tab like:


It is showing error on dashboard

Invalid Secret Key. Please refresh the page.

enter image description here

  • First of all enable formkey validation. Then check web/cookie/cookie_domain and web/cookie/cookie_path to either be correct or empty Oct 24, 2017 at 8:03
  • formkey validation is enabled. web/cookie/cookie_domain set to mydomain.com web/cookie/cookie_path set to / But still facing error Oct 24, 2017 at 10:11
  • 1
    Can you post the settings you have at General/Web/Session Cookie Management and General/Web/Session Validation Settings ? Oct 24, 2017 at 14:02
  • Here it is: screencast.com/t/GdRnK2ucNM please ignore example.com, I have changed it just for demo Oct 25, 2017 at 5:23
  • Use HTTP Only = No is a security risk. I'd reccomend you changed it back on. This is still probably a cookie issue. Have you tried logging in from another browser or computer? Oct 25, 2017 at 9:48

1 Answer 1


I had this issue on EE 1.14, and was provided SUPEE-10358 to fix (which it did!).

The patch updates one line in app/code/core/Mage/Adminhtml/Controller/Action.php

In the preDispatch() method, replace if ($_keyErrorMsg != ''){ with if (!$_isValidFormKey) { (around line 189).

I haven't tried it yet in CE, but Action.php is the same in CE 1.9, so I'm hoping this same patch will do the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.