Invalid Form Key. Please refresh the page. error on product save

Question

Hello All
I am getting this error "Invalid Form Key. Please refresh the page." whenever I try to save my product on admin panel.
I have gone through this link here but no success.
When I looked at my log file it displayed me this

2013-09-03T07:07:43+00:00 ERR (3): Notice: Undefined index: httponly  in /var/www/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php on line 94
2013-09-03T07:07:43+00:00 ERR (3): Notice: Undefined index: secure  in /var/www/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php on line 96
2013-09-03T07:07:43+00:00 ERR (3): Notice: Undefined index: domain  in /var/www/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php on line 98

I commented out the lines in the file as suggested in this article here. And the errors in log files were gone. But still not able to save my product and the error "Invalid Form Key. Please refresh the page." is as it is.
I checked the post data in firebug and it showed me

form_key    THJDhxajLIZnzrHt
form_key    {{formKey}}

as form key variables passing when I save my product. When I checked it in my local machine it displays me

form_key    prvOwOCGjSKG6DpF
form_key    {{formKey}}
form_key    prvOwOCGjSKG6DpF

something like this.
Does anyone have any idea what is wrong here. Here I can see that the last value for "form_key" passing in live is "{{formkey}}" while in local it is "prvOwOCGjSKG6DpF". Any help is appreciated.

Answer 1

There is one more source for this error: a wrong cookie_domain in the configuration. As you can't login into the admin area, you can check it directly via mysql:

SELECT * FROM core_config_data WHERE path LIKE '%cookie_domain%';

You can change the value in mysql directly as well. Don't forget to clear the cache afterwards.

Answer 2

The problem was the server configuration, i've change the max_input_vars parameter and the message dissapeared. I saw the solution in http://www.webcroppers.com/magento-invalid-form-key-please-refresh-the-page/

Answer 3

First try disabling any custom modules that you have installed and see if the problem persists.

It looks like something is injecting an extra field in to the product page which is colliding with the form_key parameter which is used by the media uploader and and other parts of the product edit page as a nonce.

Answer 4

problem with your core file.Please check for below path and code.you must have commented below code for chrome login issue.

 app/code/core/Mage/Core/Model/Session/Abstract/Varien.php:87
// session cookie params
$cookieParams = array(
    'lifetime' => $cookie->getLifetime(),
    'path'     => $cookie->getPath(),
    'domain'   => $cookie->getConfigDomain(),
    'secure'   => $cookie->isSecure(),
    'httponly' => $cookie->getHttponly()
);

if (!$cookieParams['httponly']) {
    unset($cookieParams['httponly']);
    if (!$cookieParams['secure']) {
        unset($cookieParams['secure']);
        if (!$cookieParams['domain']) {
            unset($cookieParams['domain']);
        }
    }
}

Answer 5

This bug arises due to php.ini variable "max_input_vars" Increase it to 10000 through below php function:

ini_set('max_input_vars', 10000);

OR Using linux command line

cd /etc/php/7.0/apache2/
vi php.ini (Open for edit and set max_input_vars=10000)
:wq(Press esc and write the mentioned command to save and exit)
sudo /etc/init.d/apache2 restart(Restart Server)

Answer 6

Take a closer look at your .htaccess file. When I migrate my 1.7.0 Magento store to another server I included the .htaccess file from the old server and then the message: "Invalid Form Key. Please refresh the page" pop on screen and nothing happens even configuration changes had effect. The solution was to install a fresh magento and then copy the My Store files the the Magento root, excluding .htaccess. When I used the .htaccess from the fresh installation everything starts to works fine. I don´t know what exactly happens, maybe each server structure have different and particular .htaccess entries and rules. It works to me.

Answer 7

I'm not exactly sure what the problem was, but it seems to have been the result of my Apache server's ServerName directives.

I gave the server the same global ServerName as I gave my Magento installation. Since the whole purpose of form keys (I think) has to do with security with domain names (XSRF, etc), it could be the reason.

I changed my global ServerName to, literally, "example.com".

I then cleared the Magento cache and all sessions on the remote server, and deleted the cookies on my browser.

And now it is working.

(It had nothing to do with PHP's max_input_vars in this case. I had a different problem a long time ago relating to them, though. When saving category products, only the first max_input_vars number of products would get saved, and the rest would get disassociated with the category. So you might have 10,000 products in the category already, but when you try to add 1 more in the admin, and end up with only 1,000.)