Customer Login Doesn't Work in Magento 1.9

Question

I just did a fresh installation of Magento 1.9.0.1 and I am seeing some very odd behaviour with the customer login form.

In Chrome (version 36) the login form does not work. I am just redirected to the login page. There is no error message shown on the page. However, when I open a new Incognito Window, I am able to log in just fine. Thinking this was a cookie problem, I cleared out all my cookies from the browser and tried again and I got the same results. In both cases, I am able to log in to the admin panel without any issues.

I have also tried this in both Firefox and Safari. Firefox I would see the same thing happen (but not consistently and I could fix it by clearing the cookies) and I could not replicate in Safari.

I have never had an issue with this in any other version of Magento. Is there some kind of fundamental change in the way Magento handles cookies in version 1.9 and/or is there something I can do to make this more stable?

Answer 1

I had the same problem...

The answer is that your theme does not supply a variable called form_key.

Just as stated above I have to add:

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

you add it right after <ul class="form-list">

to each one of my login.phtml files for the theme.

You may also have problems with updating the quantity of cart items

Here is the importance of form_keys:

Since the beginning of time, Magento's backend contained a form key that protected against XSS attacks [1]. With Magento 1.8 the form key has entered the frontend for pretty much the same reason: to protect against form submission from another website, using your browser. a malicious attacker can add stuff to your cart while you're in a different browser tab or even complete an order for you. This relies on predictable URLs because the site will not have access to the actual HTML content in the browser tab where you have your Magento order waiting. Everything sent to the Magento store will however submit your cookies and thus use your session.

By adding a unique key to each form or to each link that generates action on the server, the URL or form content becomes no longer predictable. The form key is stored in the session data and validated upon submission to the server. If they don't match, you get a form key error and the action is not completed.

Answer 2

It may be:

cookie setting issue in Chrome browser

OR

Magento 1.9 is using the form key validation at customer login and register page.

On Post action it check the form key using function _validateFormKey() at controller

form key issue: form key missing so add this code in your form

<input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />

OR

Cookie domain setting issue goto check setting is proper or not

at Admin -> System -> configuration -> General -> Web -> Session Cookie Management

Answer 3

As the issue seems to be cookie-related, try increasing the cookie lifetime to 86400 under

System -> Configuration -> Web -> Session and Cookie Management

The reason may be, by default cookie lifetime is set to 3600 (1 hour). But if the end-users computer time runs ahead of the server’s time, cookies will not get set for Magento frontend as well as backend. For example, the end user’s computer time is 1 hour forward than the server’s time, which means the cookie (holding user’s session-id) will expire as soon as the user logs in or tries to add an item.

Answer 4

For future readers: There are many possible causes for this issue. During login, some exception logging is suppressed for security reasons, so your problem will not show in var/log/exception.log.

To diagnose your issue:

1. Open up app/code/core/Mage/Customer/controllers/AccountController.php and go to the loginPostAction method.
2. Temporarily uncomment the Mage::logException($e); call and save the change
3. Try logging in from the front end again to trigger the same exception.
4. Look at the last error(s) in the exception log and investigate them.
5. Repeat the previous two steps until no more exceptions are thrown.

Don't forget to undo the changes to app/code/core/Mage/Customer/controllers/AccountController.php!

The cause of my problem was a class was failing to autoload because the module (incorrectly) had <codePool>community</codePool> instead of <codePool>local</codePool>.

Answer 5

I fixed the issue by just adding the below line of code in persistent login phtml file.

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

Answer 6

ok after strugling for half hours i found out exactly in which folders login.phtml i have to change. So go to

/app/design/frontend/default/template-name/template/persistent/customer/form/

and paste

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

after

<ul class="form-list">

thats it.

Answer 7

If you are using Varnish cache, there might be a different problem. I am quoting a solution I found elsewhere. https://github.com/nexcess/magento-turpentine/issues/169

And here we go... The last time it happened to me this problem with the login I noticed that I had "got" two different cookies with the same name "frontend". All the fields of these cookies were identical except for the "domain" field.

In the first cookie, the domain value was "mydomain.com" whereas in the second was "www.mydomain.com".

This happens when a user doesn't already have a frontend cookie and types "mydomain.com" in his browser's URL. This triggers the faulty "frontend" cookie to be set and messes things up!

Back in our server, we have a rule that if a web user hits "mydomain.com" to serve him the "www.mydomain.com".

This means that in the user's browser, in the address bar the URL is turned from "mydomain.com" to "www.mydomain.com".

I am not sure that this has something to do with the login problem. I just mentioned it.

Solution: At Magento configuration at turpentine caching options there is an option "Normalise host". You have to enable it. That's it!

After this no messy thing no double frontend cookies! Hope this helps!

Answer 8

The reason for this issue is the custom login form does not contain any form_key and there is a form key validation happening in loginPostAction of Magento.

You can fix it as below:

1. Go to app/design/frontend/[Your-package]/[Your-theme]/template/customer/form/login.phtml

Find: <ul class=”form-list”> and paste below code right after this:

<div class="codepen" data-height="99" data-theme-id="8142" data-slug-hash="Bewri" data-default-tab="html">
<pre><code><input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->;getFormKey(); ?>" /></code></pre>
</div>

2. Go to app/design/frontend/Your-package]/[Your-theme]/template/persistent/customer/form/login.phtml and apply the same changes.

Answer 9

The above worked for me absolutely fine but I was upgrading from Magento 1.4.1 to 1.9.1 so a huge leap. The files were nowhere to be found in the location above but were located in the app / design / frontend / BASE folder.

/app/design/frontend/BASE/default/template/persistent/customer/form/

This base folder holds a lot of common files since Magento 1.4 so I read... Hopefully this will save someone the many hours of works that it took me..

Answer 10

If you are using any social login extension then also add form key in that login.phtm file

Answer 11

Make sure php-mbstring is installed and enabled on your server.

If it's not then admin login will work while customer won't.

This check can be done by looking into the output of phpinfo() or by temporarily enabling login exception around the line 177 in: app/code/core/Mage/Customer/controllers/AccountController.php

Do be aware that the operation can disclose customer passwords in the logged exception trace.

Answer 12

I had the same problem and solved it by deleting all cookies. The problem seems to happen if you have multiple different magento shops and login to them at the same time.