I have installed Magento 1.9. It was working well for a week. Suddenly yesterday, when I tried to log in to the Magento admin panel and I typed username and password, clicked the Login button and nothing happened. The page refreshes and that’s all. No error or any other messages.

If I entered the wrong username or password, It shows an error.

After I googled about this issue, I was recommended to comment the following lines in:


/* to solve login issue */
  /*if (!$cookieParams['httponly']) {
  if (!$cookieParams['secure']) {
  if (!$cookieParams['domain']) {
if (isset($cookieParams['domain'])) {
  $cookieParams['domain'] = $cookie->getDomain();*/ //I have commented these lines

And for some older versions below was recommended in the same file.

$cookieParams = array(           
    'lifetime' => $cookie->getLifetime(),           
    'path'     => $cookie->getPath(),           
    //'domain'   => $cookie->getConfigDomain()           
    //'secure'   => $cookie->isSecure(),           
    //'httponly' => $cookie->getHttponly()       

Even after that, I could not log in to admin. It is as it was. Did anyone face this issue? Is there any other solution to this issue?

(I tried clearing cache and session through FTP).

  • could you please clear the browser cache/cookie and try again?
    – alamelu
    Commented Jul 5, 2014 at 18:21
  • Copy core files to app/code/local/Mage/Core..blahblah for editing so Magento overrides the core file. Also use git for version control, it is a godsend.
    – Krista K
    Commented Sep 11, 2014 at 20:05
  • @SHIBHI S, refere this link magentolearning.com/can-not-login-magento-admin-panel Commented Oct 18, 2014 at 5:02
  • 1
    If you're using Chrome, key F12 > Resources > Cookies > Right-click your domain > Clear.
    – rybo111
    Commented Jun 16, 2015 at 15:49

18 Answers 18


While it may offer you a temporarily solution, you should considering not modifying the core code like that to solve problems. Changing the source code of an application will create problems that are much more difficult to track down.

There's a number of different issues that cause the errorless admin login behavior you're seeing, but they all go back to Magento not being able to set or read the session cookie. Magento uses sessions to pass error messages between pages — that's why you don't see an error message. Magento also uses sessions to store the "is logged in" value, so not setting sessions also causes the core error behavior.

Possible causes include

  • Local computer time vs. server time mismatch, causing instant cookie invalidation. Make sure your server time is correct.

  • Incorrect permissions on var/session, preventing session files from being saved

  • Incorrect configuration of database/redis/other session storage, preventing saving of session values

  • A module is instantiating sessions to early, preventing the correct session names from being set

  • You're a developer using multiple URLs and have multiple cookie domains

  • Another developer has somehow modified app\code\core\Mage\Core\Model\Session\Abstract\Varien.php, creating a hard to track down bug

  • The cookie domain in System -> Configuration -> Web -> Session Cookie Management doesn't match the actual site domain.

  • You're using the localhost as your server domain, and using a version of webkit that has trouble/bugs setting cookies for localhost in some situations.

The short term fix is to just delete your cookie for the domain. That's often enough to solve the problem. If it persists, figure out which of the above reasons is the reason for your error, and take steps to address it (fix permissions, etc.)

  • 8
    You can use n98-magerun's sys:check command to find problems with cookie domain and base url. magerun.net/quick-tip-find-login-issues-with-syscheck-command
    – cmuench
    Commented Jul 5, 2014 at 18:57
  • 1
    @Alan Storm, Thank you for the clear explanation. I solved my issue. In my case, reason of issue is 3rd one.
    – SIBHI S
    Commented Jul 12, 2014 at 10:45
  • 4
    In my case, there was not enough disk space on the server. So you may want to add this as a possible cause.
    – Simon
    Commented Jan 12, 2015 at 13:41
  • @cmuench I run that command and I don't understand results: Invalid Unsecure BaseURL Store: default Wrong hostname configured. Hostname must contain a dot ✖ Invalid Unsecure BaseURL Store: french Wrong hostname configured. Hostname must contain a dot ✖ Invalid Unsecure BaseURL Store: sot_eng Wrong hostname configured. Hostname must contain a dot ✖ Invalid Unsecure BaseURL Store: sot_fra Wrong hostname configured. Hostname must contain a dot ✔ Cookie Domain (secure) of Store: default OK - No domain set All Cookie domain look the same Ok and No domain set
    – Denisa
    Commented Feb 13, 2015 at 11:02
  • @Denisa You'll have a bit more luck if you try asking that as a new question. Commented Feb 13, 2015 at 15:08

I'm having the same symptoms on some Magento installations(not only 1.9). In my case, it happens only in Chrome. I'm fixing this by logging in Firefox/Safari/Opera, and changing 'Use HTTP only' to 'No' in 'Session Cookies Management' of the 'Web' settings.

See Magento's backend screenshot with cookies settings

  • 3
    This helped me get my development environment running in Chrome, but remember not to use these settings in production as it opens up a whole class of security vulnerabilities. Commented Oct 19, 2014 at 0:50
  • where is the Session Cookies Management section? Commented Aug 26, 2015 at 4:41
  • 1
    Also check your cookie domain - I was developing locally and this turned out to be my issue. Commented Nov 10, 2015 at 19:18
  • Helped me a lot! Never knew that this only happens in Chrome. Haha!
    – jehzlau
    Commented Nov 14, 2015 at 4:43
  • 4
    To set Use HTTP only to No without admin panel access. You can launch directly this SQL query : UPDATE __DATABASE_NAME__.core_config_data SET value = '0' WHERE core_config_data.path = 'web/cookie/cookie_httponly';
    – Nolwennig
    Commented Dec 8, 2015 at 9:12

I had this problem too. Turned out sessions couldn't get written to var/session, even though the directory itself is set to 0777. Magento created session files, but they all remained zero bytes.

Changing session storage from files to db solved the problem for me.

  • this works! I don't understand why Magento doesn't write the sessions and cache on files. The permissions are correct! Commented Jun 6, 2016 at 15:09
  • If I recall my situation, it was either that the disk was full, or that the session directory had too much files. Commented Jan 4, 2017 at 13:25
  • This one works for me!!
    – Ner
    Commented Nov 11, 2017 at 17:16
  • In my case: Changing session storage from db to files resolved issue.
    – akgola
    Commented Apr 12, 2018 at 4:58
  1. Open your Magento installation directory. Locate and open index.php file.
  2. Search for error_reporting(E_ALL | E_STRICT); code.
  3. Comment it out like that:

    /*error_reporting(E_ALL | E_STRICT);*/

  4. And use the following code instead:



  5. Uncomment it by removing the # sign, so it looks like that:

    ini_set('display_errors', 1);

  6. Save this file and upload to the server. Reload your website page to see errors.


Another possible reason: harddisk/volume/quota is full and so the session data can't be written to disk. May seem unlikely, but just happened the second time to me and took a while to figure out.

I don't have enough reputation to comment, but @Alan Storm, maybe you want to take this in your excellent list.


I recently had the same problem and simple trick worked for me. Also this is for people who cannot access the dashboard on Google Chrome. If you can work on Mozilla Firefox then please do so because I guess this issue is not persistent on Mozilla firefox.

So the solution for chrome is:

Goto System->Configuration->Web. Expand the Unsecure and Secure tab. Change the Base URL to[Your folder name] if you are using localhost or change it to your Site URL through which you are accessing the frontend. I had to login twice to get to the Dashboard since when I entered the details for the first time, it just refreshes and comes back to the same page as you mentioned it as looping.


Open your phpMyAdmin from your host try once this sql command.

Run this SQL:

UPDATE core_store SET store_id = 0 WHERE code='admin';
UPDATE core_store_group SET group_id = 0 WHERE name='Default';
UPDATE core_website SET website_id = 0 WHERE code='admin';
UPDATE customer_group SET customer_group_id = 0 WHERE customer_group_code='NOT LOGGED IN';SET FOREIGN_KEY_CHECKS=1;

Now admin can able to log in.

Please follow this:

Admin page shows 404 pages not found

  • 1
    don't forget to open in anonymous window or another browser for removing sessions
    – Martin
    Commented Jun 7, 2016 at 13:15

I had the same problem and I solved it by deleting all files in /var/session . I think it's because too many session in Magento!


Alarm Storm List is correct and detailed. Here are couple of additional cases.

  1. In vagrant, check permission of var/session on host Machine too
    (mounting issues)
  2. Check if you disk is full or too many files in var/session
  3. Run n98-magerun.phar sys:check (catches issues including cookie domain)
  4. Change session to database by editing local.xml. It will rule out most permission issues by using insidie <global>


Also be vary of third party extensions (firewall/security extensions) for example https://github.com/paimpozhil/MageFirewall/blob/master/app/code/community/MageFirewall/Firewall/Model/Observer.php#L53 puts you on black list if you try too many times.

Can happen if your session is originally not working for permission issues but then continue failing even after you fix original issue

In your particular case keep an eye on admin_session_user_login_success event as most security /firewall modules use this event. Specially keep an eye if variable $_SESSION['admin'] is reset by observers


It’s also important that you have a form key present, otherwise your form won’t get processed.

<?php echo $this->getBlockHtml('formkey'); ?>

A simple solution to this problem is to use as you hostname instead of localhost.

Since the problem is that you cannot log in to your admin, you should change the secure and unsecure base urls in the database tabel: core_config_data

This will also have your baseurl validate with n98-magerun's sys:check


If you are developing on localhost and have set or changed your domain name to localhost, update your database table core_config_data domain names to instead. E.g. UPDATE core_config_data SET value="" WHERE path="web/unsecure/base_url";


Also, you can update the password in the database if everything else from above didn't work and you need desperate access:

UPDATE admin_user SET password=CONCAT(MD5('qXpassword'), ':qX') WHERE username=‘user’;

replace user and password words according to your needs.


First of all try to clear you cache I think and if this does not work, try to make chmod 700 on your var folder.


You can changed your browser may be this work for me . When this error comes i have changed browser chrome to firefox and it working .


The same thing happened with me a while ago and my problem came from the session. I didn't have enough DISK space to create the sessions and cache from var/. I removed some stuff and everything worked after. Maybe it will help someone.



Try to clear your cache by emptying the folder "var/cache" and "var/session", this solved it for me.

I also had to restart the webserver after it once.


For me the error was with the default CAPTCHA of magento. Set "Enable CAPTCHA in Admin" to "No". If you don't have a seccond admin user to login change this to DB.

UPDATE `core_config_data` SET `value`='0' WHERE  `path`= "admin/captcha/enable";

If you want to check the exact error change TEMPORARY file app/code/core/Mage/Admin/Model/Session.php. (Remember to restore the file back after you check the error.)

public function login($username, $password, $request = null)
    } catch (Mage_Core_Exception $e) {
            Mage::helper('adminhtml')->__('You did not sign in correctly or your account is temporarily disabled.')

Show the actual error

public function login($username, $password, $request = null)
    } catch (Mage_Core_Exception $e) {

Not the answer you're looking for? Browse other questions tagged or ask your own question.