With magento config:set admin/security/use_form_key 0

People say that sometimes they are logged into each others accounts. I'm not sure how this is possible since they never log into each others computers and thus wouldn't even have the session cookie. We go through cloudflare, but that should make no difference at all. We use redis but that too should make no difference at all. It does have us a bit worried though.

Having form keys on is a huge pain as we can't copy an admin url and give it to someone else. It's really upsetting it does this with form keys off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.