After new magento 1.9 installation when I am login to the admin panel there is a fine flow.

After that if I am opening admin panel on other tab like:


It is showing error on dashboard

Invalid Secret Key. Please refresh the page.

enter image description here

  • First of all enable formkey validation. Then check web/cookie/cookie_domain and web/cookie/cookie_path to either be correct or empty – Yiorgos Moschovitis Oct 24 '17 at 8:03
  • formkey validation is enabled. web/cookie/cookie_domain set to mydomain.com web/cookie/cookie_path set to / But still facing error – Shoaib Munir Oct 24 '17 at 10:11
  • 1
    Can you post the settings you have at General/Web/Session Cookie Management and General/Web/Session Validation Settings ? – Yiorgos Moschovitis Oct 24 '17 at 14:02
  • Here it is: screencast.com/t/GdRnK2ucNM please ignore example.com, I have changed it just for demo – Shoaib Munir Oct 25 '17 at 5:23
  • Use HTTP Only = No is a security risk. I'd reccomend you changed it back on. This is still probably a cookie issue. Have you tried logging in from another browser or computer? – Yiorgos Moschovitis Oct 25 '17 at 9:48

I had this issue on EE 1.14, and was provided SUPEE-10358 to fix (which it did!).

The patch updates one line in app/code/core/Mage/Adminhtml/Controller/Action.php

In the preDispatch() method, replace if ($_keyErrorMsg != ''){ with if (!$_isValidFormKey) { (around line 189).

I haven't tried it yet in CE, but Action.php is the same in CE 1.9, so I'm hoping this same patch will do the trick.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.