I have recently upgraded from 2.3.7 to 2.4.3 and since the upgrade I am seeing

"Invalid security or form key. Please refresh the page."

on every page in admin. (frontend works fine)

Most things in the backend still work even with the error present apart from the ability to add products to a manual order in the backend. I have disabled all 3rd party modules and set max_input_vars to 200000 but it doesn't solve the error.

I have cleared all caches and removed all generated code etc and also run setup:upgrade. I have also checked to ensure cookie path and domain are valid. But still the error shows! Anyone have any other ideas? Or how I can debug further? Thanks.

3 Answers 3


I found this in the error logs:

main.WARNING: Session size of 271329 exceeded allowed session max size of 256000

Setting the max_session_size_admin to unlimited resolved the issue:

php bin/magento config:set system/security/max_session_size_admin 0

This is a newly introduced issue in 2.4.3.

You need to make changes described here, to ger rid of this message: https://github.com/magento/magento2/issues/33749#issuecomment-908145941

The file is found in: \vendor\magento\module-backend\App\Action\Plugin\Authentication.php

Good Luck,

  • Very good to know this thank you. Although it was not the cause of my issue it will certainly help people who find this post in the future. Thanks.
    – sulman
    Commented Sep 8, 2021 at 8:33

You should check the cookie setting Stores > Configuration > General > Web Default Cookie Settings > Cookie Domain

  • Thank you! I forgot to mention in my original post that I have checked these values. Updating/removing them has no effect. I have edited my post to include this information. Thanks!
    – sulman
    Commented Sep 6, 2021 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.