I just did a fresh installation of Magento and I am seeing some very odd behaviour with the customer login form.

In Chrome (version 36) the login form does not work. I am just redirected to the login page. There is no error message shown on the page. However, when I open a new Incognito Window, I am able to log in just fine. Thinking this was a cookie problem, I cleared out all my cookies from the browser and tried again and I got the same results. In both cases, I am able to log in to the admin panel without any issues.

I have also tried this in both Firefox and Safari. Firefox I would see the same thing happen (but not consistently and I could fix it by clearing the cookies) and I could not replicate in Safari.

I have never had an issue with this in any other version of Magento. Is there some kind of fundamental change in the way Magento handles cookies in version 1.9 and/or is there something I can do to make this more stable?

  • can u share the link and test user/pass
    – MTM
    Aug 11, 2014 at 16:42
  • Unfortunately it's all tied up behind my work's VPN. Aug 11, 2014 at 16:59
  • Reinstall Chrome and verify.
    – Niloct
    Aug 11, 2014 at 17:08
  • Same results after reinstalling. Aug 11, 2014 at 17:21
  • 1
    i was once having a similar issue in a clients site, the problem was, when the site was accessed without www e.g. abc.com it was then redirected to www.abc.com. In this case, the browser was setting the cookies for both and logins specially stopped working, but if i manually delete the cookie that was without www the logins start working again.Can you check if same is the case with you too?
    – MTM
    Aug 11, 2014 at 19:09

12 Answers 12


I had the same problem...

The answer is that your theme does not supply a variable called form_key.

Just as stated above I have to add:

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

you add it right after <ul class="form-list">

to each one of my login.phtml files for the theme.

You may also have problems with updating the quantity of cart items

Here is the importance of form_keys:

Since the beginning of time, Magento's backend contained a form key that protected against XSS attacks [1]. With Magento 1.8 the form key has entered the frontend for pretty much the same reason: to protect against form submission from another website, using your browser. a malicious attacker can add stuff to your cart while you're in a different browser tab or even complete an order for you. This relies on predictable URLs because the site will not have access to the actual HTML content in the browser tab where you have your Magento order waiting. Everything sent to the Magento store will however submit your cookies and thus use your session.

By adding a unique key to each form or to each link that generates action on the server, the URL or form content becomes no longer predictable. The form key is stored in the session data and validated upon submission to the server. If they don't match, you get a form key error and the action is not completed.

  • 3
    Add the above "form_key" hidden input to the form located: app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
    – Flipmedia
    Oct 28, 2014 at 20:07
  • 5
    A much better snippet of code to use would be <?php echo $this->getBlockHtml('formkey'); ?> rather than the large input.
    – Navarr
    Dec 5, 2014 at 16:43
  • Paste this before form closing tag <?php echo $this->getBlockHtml('formkey'); ?> Feb 27, 2015 at 19:34
  • beautiful, this worked for me. Thank you very much I up-voted! Feb 2, 2017 at 1:23
  • Waow, I searched so long for this >.<! Thanks a lot! Apr 10, 2019 at 10:02

It may be:

cookie setting issue in Chrome browser


Magento 1.9 is using the form key validation at customer login and register page.

On Post action it check the form key using function _validateFormKey() at controller

form key issue: form key missing so add this code in your form

<input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />


Cookie domain setting issue goto check setting is proper or not

at Admin -> System -> configuration -> General -> Web -> Session Cookie Management

  • 1
    The login form does have the form_key field already and I set the Cookie Domain and that also did not fix it. Aug 11, 2014 at 17:13
  • please delete cookie from browser Or Goto accountcontroller.php check if (!$this->_validateFormKey()) { is working or not
    – Amit Bera
    Aug 11, 2014 at 17:15
  • The form key is validating properly. In fact, it looks like loginPostAction is running perfectly fine. Aug 11, 2014 at 17:31
  • 1
    @AmitBera Shall I meet you magento chat? I have related issue on wishlist module?
    – Anto S
    Jul 5, 2016 at 7:24
  • @AmitBera I have set the key, but still its not working. Also in accountcontroller.php if (!$this->_validateFormKey()) { returns false which means Magento is unable to validate the supplied key. ANy idea why does it happen?
    – Arvind07
    Apr 19, 2017 at 3:55

As the issue seems to be cookie-related, try increasing the cookie lifetime to 86400 under

System -> Configuration -> Web -> Session and Cookie Management

The reason may be, by default cookie lifetime is set to 3600 (1 hour). But if the end-users computer time runs ahead of the server’s time, cookies will not get set for Magento frontend as well as backend. For example, the end user’s computer time is 1 hour forward than the server’s time, which means the cookie (holding user’s session-id) will expire as soon as the user logs in or tries to add an item.

For future readers: There are many possible causes for this issue. During login, some exception logging is suppressed for security reasons, so your problem will not show in var/log/exception.log.

To diagnose your issue:

  1. Open up app/code/core/Mage/Customer/controllers/AccountController.php and go to the loginPostAction method.
  2. Temporarily uncomment the Mage::logException($e); call and save the change
  3. Try logging in from the front end again to trigger the same exception.
  4. Look at the last error(s) in the exception log and investigate them.
  5. Repeat the previous two steps until no more exceptions are thrown.

Don't forget to undo the changes to app/code/core/Mage/Customer/controllers/AccountController.php!

The cause of my problem was a class was failing to autoload because the module (incorrectly) had <codePool>community</codePool> instead of <codePool>local</codePool>.

  • 1
    I tried your solution but there is no exception.log being created although I cannot login!
    – Jon
    Dec 2, 2016 at 9:37

I fixed the issue by just adding the below line of code in persistent login phtml file.

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />
  • 1
    Thanks for the solution. I have wasted almost half day on it. And finally found this solution. May 24, 2017 at 11:21

ok after strugling for half hours i found out exactly in which folders login.phtml i have to change. So go to


and paste

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />


<ul class="form-list">

thats it.


If you are using Varnish cache, there might be a different problem. I am quoting a solution I found elsewhere. https://github.com/nexcess/magento-turpentine/issues/169

And here we go... The last time it happened to me this problem with the login I noticed that I had "got" two different cookies with the same name "frontend". All the fields of these cookies were identical except for the "domain" field.

In the first cookie, the domain value was "mydomain.com" whereas in the second was "www.mydomain.com".

This happens when a user doesn't already have a frontend cookie and types "mydomain.com" in his browser's URL. This triggers the faulty "frontend" cookie to be set and messes things up!

Back in our server, we have a rule that if a web user hits "mydomain.com" to serve him the "www.mydomain.com".

This means that in the user's browser, in the address bar the URL is turned from "mydomain.com" to "www.mydomain.com".

I am not sure that this has something to do with the login problem. I just mentioned it.

Solution: At Magento configuration at turpentine caching options there is an option "Normalise host". You have to enable it. That's it!

After this no messy thing no double frontend cookies! Hope this helps!


The reason for this issue is the custom login form does not contain any form_key and there is a form key validation happening in loginPostAction of Magento.

You can fix it as below:

  1. Go to app/design/frontend/[Your-package]/[Your-theme]/template/customer/form/login.phtml

Find: <ul class=”form-list”> and paste below code right after this:

<div class="codepen" data-height="99" data-theme-id="8142" data-slug-hash="Bewri" data-default-tab="html">
<pre><code><input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->;getFormKey(); ?>" /></code></pre>
  1. Go to app/design/frontend/Your-package]/[Your-theme]/template/persistent/customer/form/login.phtml and apply the same changes.

The above worked for me absolutely fine but I was upgrading from Magento 1.4.1 to 1.9.1 so a huge leap. The files were nowhere to be found in the location above but were located in the app / design / frontend / BASE folder.


This base folder holds a lot of common files since Magento 1.4 so I read... Hopefully this will save someone the many hours of works that it took me..


If you are using any social login extension then also add form key in that login.phtm file

  • 1
    <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> Nov 28, 2016 at 6:45

Make sure php-mbstring is installed and enabled on your server.

If it's not then admin login will work while customer won't.

This check can be done by looking into the output of phpinfo() or by temporarily enabling login exception around the line 177 in: app/code/core/Mage/Customer/controllers/AccountController.php

Do be aware that the operation can disclose customer passwords in the logged exception trace.


I had the same problem and solved it by deleting all cookies. The problem seems to happen if you have multiple different magento shops and login to them at the same time.

Not the answer you're looking for? Browse other questions tagged or ask your own question.