I just did a fresh installation of Magento and I am seeing some very odd behavior with the customer login form.

In Chrome (version 36) the login form does not work. I am just redirected to the login page. There is no error message. However, when I open a new Incognito Window, I am able to login just fine. Thinking this was a cookie problem, I cleared out all my cookies from the browser and tried again and I got the same results. In both cases, I am able to login to the admin panel without any issues.

I have also tried this in both Firefox and Safari. Firefox I would see the same thing happen (but not consistently and I could fix it by clearing the cookies) and I could not replicate in Safari.

I have never had an issue with this in any other version of Magento. Is there some kind of fundamental change in the way Magento handles cookies in version 1.9 and/or is there something I can do to make this more stable?

  • can u share the link and test user/pass – MTM Aug 11 '14 at 16:42
  • Unfortunately it's all tied up behind my work's VPN. – Josh Pennington Aug 11 '14 at 16:59
  • Reinstall Chrome and verify. – Niloct Aug 11 '14 at 17:08
  • Same results after reinstalling. – Josh Pennington Aug 11 '14 at 17:21
  • 1
    i was once having a similar issue in a clients site, the problem was, when the site was accessed without www e.g. abc.com it was then redirected to www.abc.com. In this case, the browser was setting the cookies for both and logins specially stopped working, but if i manually delete the cookie that was without www the logins start working again.Can you check if same is the case with you too? – MTM Aug 11 '14 at 19:09

12 Answers 12


I had the same problem....

The answer is that your theme does not supply a variable called form_key.

Just as stated above I have to add:

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

you add it right after <ul class="form-list">

to each one of my login.phtml files for the theme.

You may also have problems with update quantity of cart items

Here is the importance of form_keys:

Since the beginning of time, Magento's backend contained a form key that protected against XSS attacks [1]. With Magento 1.8 the form key has entered the frontend for pretty much the same reason: to protect against form submission from another website, using your browser. a malicious attacker can add stuff to your cart while you're in a different browser tab or even complete an order for you. This relies on predictable URLs, because the site will not have access to the actual HTML content in the browser tab where you have your Magento order waiting. Everything sent to the Magento store will however submit your cookies and thus use your session.

By adding a unique key to each form or to each link that generates an action on the server, the URL or form content becomes no longer predictable. The form key is stored in the session data and validated upon submission to the server. If they don't match, you get a form key error and the action is not completed.

| improve this answer | |
  • 3
    Add the above "form_key" hidden input to the form located: app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml – Flipmedia Oct 28 '14 at 20:07
  • 5
    A much better snippet of code to use would be <?php echo $this->getBlockHtml('formkey'); ?> rather than the large input. – Navarr Dec 5 '14 at 16:43
  • Paste this before form closing tag <?php echo $this->getBlockHtml('formkey'); ?> – Tahir Yasin Feb 27 '15 at 19:34
  • beautiful, this worked for me. Thank you very much I up-voted! – CodingMageSheen Feb 2 '17 at 1:23
  • Waow, I searched so long for this >.<! Thanks a lot! – Keenora Fluffball Apr 10 '19 at 10:02

It may be:

cookie setting issue in Chrome browser


Magento 1.9 is using form key validation at customer loggin and register page.

On Post action it check the form key using function _validateFormKey() at controller

form key issue: form key missing so add this code in your form

<input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />


Cookie domain setting issue goto check setting is proper or not

at Admin>System>configuration>General>Web>Session Cookie Management

| improve this answer | |
  • 1
    The login form does have the form_key field already and I set the Cookie Domain and that also did not fix it. – Josh Pennington Aug 11 '14 at 17:13
  • please delete cookie from browser Or Goto accountcontroller.php check if (!$this->_validateFormKey()) { is working or not – Amit Bera Aug 11 '14 at 17:15
  • The form key is validating properly. In fact, it looks like loginPostAction is running perfectly fine. – Josh Pennington Aug 11 '14 at 17:31
  • 1
    @AmitBera Shall I meet you magento chat? I have related issue on wishlist module? – Butterfly Jul 5 '16 at 7:24
  • @AmitBera I have set the key, but still its not working. Also in accountcontroller.php if (!$this->_validateFormKey()) { returns false which means Magento is unable to validate the supplied key. ANy idea why does it happen? – Arvind07 Apr 19 '17 at 3:55

As the issue seems to be cookie related, try increasing the cookie life time to 86400 under

Sytem -> Configuration -> Web -> Session and Cookie Management

The Reason may be, by default cookie lifetime is set to 3600 (1 hour). But if the end users computer time runs ahead of server’s time, cookies will not get set for Magento frontend as well as backend. For example, end user’s computer time is 1 hour forward than server’s time, that means the cookie (holding user’s session id) will expire as soon as user logs in or tries to add an item.

| improve this answer | |

For future readers: There are many possible causes for this issue. During login, some exception logging is suppressed for security reasons, so your problem will not show in var/log/exception.log.

To diagnose your issue:

  1. Open up app/code/core/Mage/Customer/controllers/AccountController.php and go to the loginPostAction method.
  2. Temporarily uncomment the Mage::logException($e); call and save the change
  3. Try logging in from the front end again to trigger the same exception.
  4. Look at the last error(s) in the exception log and investigate them.
  5. Repeat the previous two steps until no more exceptions are thrown.

Don't forget to undo the changes to app/code/core/Mage/Customer/controllers/AccountController.php!

The cause of my problem was a class was failing to autoload because the module (incorrectly) had <codePool>community</codePool> instead of <codePool>local</codePool>.

| improve this answer | |
  • I tried your solution but there is no exception.log being created although I cannot login! – Jon Dec 2 '16 at 9:37

I fixed the issue by just adding the below line of code in persistent login phtml file.

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />
| improve this answer | |
  • 1
    Thanks for the solution. I have wasted almost half day on it. And finally found this solution. – Gaurav Agrawal May 24 '17 at 11:21

ok after strugling for half hours i found out exactly in which folders login.phtml i have to change. So go to


and paste

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />


<ul class="form-list">

thats it.

| improve this answer | |

If you are using Varnish cache, there might be a different problem. I am quoting a solution i found elsewhere. https://github.com/nexcess/magento-turpentine/issues/169

And here we go... The last time it happened to me this problem with the login I noticed that I had "got" two different cookies with the same name ."frontend".All the fileds of these cookies were identical except from the "domain" field.In the first cookie the domain value was "mydomain.com" whereas in the second was "www.mydomain.com" . This happens when a user doesnt already have a frontend cookie and types "mydomain.com" in his browser's url . This triggers the faulty "frontend" cookie to be set and messes things up! Back in our server we have a rule that if a web user hits "mydomain.com" to serve him the "www.mydomain.com". This means that in the user's browser ,in the address bar the url is turned from "mydomain.com" to "www.mydomain.com". I am not sure that this has something to do with log in problem. I just mention it. Solution: At magento configuration at turpentine caching options there is an option "Normalise host".You have to enable it. Thats it!After this no messy thing no double frontend cookies! Hope this helps!

| improve this answer | |

The reason for this issue is the custom login form does not contain any form_key and there is a form key validation happening in loginPostAction of Magento.

You can fix it as below:

  1. Go to app/design/frontend/[Your-package]/[Your-theme]/template/customer/form/login.phtml


and paste this right after the code above:

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />
  1. Go to app/design/frontend/Your-package]/[Your-theme]/template/persistent/customer/form/login.phtml and apply the same changes.
| improve this answer | |

The above worked for me absolutely fine but I was upgrading from Magento 1.4.1 to 1.9.1 so a huge leap. The files were nowhere to be found in the location above but were located in the app / design / frontend / BASE folder.


This base folder holds a lot of common files since Magento 1.4 so I read... Hopefully this will save someone the many hours of works that it took me..

| improve this answer | |

If you are using any social login extension then also add form key in that login.phtm file

| improve this answer | |
  • 1
    <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> – Yatin Patel Nov 28 '16 at 6:45

Make sure php-mbstring is installed and enabled on your server.

If it's not then admin login will work while customer won't.

This check can be done by looking into output of phpinfo() or by temporarily enabling login exception around line 177 in: app/code/core/Mage/Customer/controllers/AccountController.php

Do be aware that operation can disclose customer password in the logged exception trace.

| improve this answer | |

I had the same problem and solved it by deleting all cookies. The problem seems to happen if you have multiple different magento shops and login to them at the same time.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.