I've just enabled Varnish on a site using the Turpentine extension. Everything's fine except I have a login form in the header.

If I use this form on a unsecure page, then it redirects me to the normal login page. If I use this form on a secure page, it works as expected and the customer is logged in.

Everything was working fine before I enabled Varnish.

The login form has the action "https://..../customer/account/loginPost/"

Any ideas what I can change to get this to work?

  • so your login block is cached or not redirects, or you can not login or what?
    – user2857
    Commented Dec 29, 2014 at 10:32
  • Are you using anything like pound infront of Varnish to have it cache secure pages as well? What does the request return, Varnish hit/miss, is there a redirect? Need more details... Commented Dec 29, 2014 at 12:18

3 Answers 3


Is Varnish enabled for https? Probably related to form_key session variable being cached thus failing CSRF check which was added in Magento

  • In the end this was the closest answer I could find. It was specific to the site Commented Feb 4, 2015 at 3:31

Seems like an error of ssl certificates, Reomove the https and use only http. Does your site have ssl certificate ?

  • Hello, yes it does have a valid SSL certificate. Everything was working until Varnish was enabled. Commented Dec 29, 2014 at 5:53

This sounds like it could be a form_key issue. Basically the login form has a hidden form_key input which is generated each time a page is loaded. As you are varnishing the content on your insecure pages the form key is no longer being generated, its just a static value that has been cached.

To get around this problem you can "punch holes" in varnish so that the login form isn't cached. This is usually done by either loading dynamic content in with an ajax request post page load and injecting it into the page, or by using varnish Edge Side Includes. I don't use Turpintine so cannot tell you how to configure it, but it looks like it supports both of these options.

  • This is a poor quality answer. You should explain a bit the hole punching idea.
    – Marius
    Commented Dec 29, 2014 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.