I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page."

Upon debugging, I found that CSRF validation fails when CC avenue posts response on return URL. While I also tried solution mentioned on the post : Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint, still the error persists. Possible reason could be that interface mentioned in above post is not being used rather it gets into Magento\Framework\App\Request\CsrfValidator class which implements Magento\Framework\App\Request\ValidatorInterface.

Possible workaround is to override class - Magento\Framework\App\Request\CsrfValidator as follows:

public function validate(
        RequestInterface $request,
        ActionInterface $action
    ): void {
        try {
            $areaCode = $this->appState->getAreaCode();
        } catch (LocalizedException $exception) {
            $areaCode = null;
        if ($request instanceof HttpRequest
            && in_array(
                [Area::AREA_FRONTEND, Area::AREA_ADMINHTML],
        ) {
            //Custom code
            if ($request->getRequestUri() == 'custom/uri')
                $valid = true;
            else {
                $valid = $this->validateRequest($request, $action);
            if (!$valid) {
                    throw $this->createException($request, $action);

Question is - how do I override this class? I tried writing dependency injection but did not work!

  • I have also faced the same issue. The solution in the link is working for me. Commented Feb 7, 2019 at 12:38
  • @Sree - For which version of Magento you faced this issue? I am facing it for Magento 2.3.0 Commented Feb 8, 2019 at 6:32
  • When you say you tried writing dependency injection, do you mean that you tried setting a Preference in di.xml? If not, that'd be my first thing to try Commented Feb 11, 2019 at 13:53
  • @zack6849 - Yes I tried preference in di.xml with no luck. Commented Feb 13, 2019 at 5:07

2 Answers 2


You can add a formKey to your request.

Magento checks in the validateRequest function at Magento\Framework\App\Request\CsrfValidator if the request is intance of CsrfAwareActionInterface, not a post request, ajax or has a valide formKey:

private function validateRequest(
        HttpRequest $request,
        ActionInterface $action
    ): bool {
        $valid = null;
        if ($action instanceof CsrfAwareActionInterface) {
            $valid = $action->validateForCsrf($request);
        if ($valid === null) {
            $valid = !$request->isPost()
                || $request->isAjax()
                || $this->formKeyValidator->validate($request);

        return $valid;

You can inject Magento\Framework\Data\Form\FormKey and add to your request, something like this:

 $requestUrl .= '?form_key=' . $this->formKey->getFormKey();
  • you are welcome
    – gemig_hol
    Commented Feb 13, 2019 at 10:38
  • 1
    @gemig_hol is this solution just for the cases where you specify a return url dynamically? Or can it also be used if the payment gateway webhook is always the same (pre-configured)
    – snez
    Commented Mar 20, 2019 at 10:10
  • 1
    @snez the two payment method I worked I could add the form key to the request, I suppose if you can't change the return url this won't work.
    – gemig_hol
    Commented Mar 27, 2019 at 14:13
  • M 2.3.3 Controller implementing CsrfAwareActionInterface was failing until added above workaround. Thanks for Sharing
    – Flipmedia
    Commented Mar 2, 2020 at 23:53

I went into the same problem on Magento 2.3.2 and found this buggy validation on 2.3.* versions.

I found the solution and a very simple composer package to make it easier for others.

This package simply disables the CSRF validation. Please use:

composer require gustavoulyssea/magento-csrf-validator-skip

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.