I am using magento 1.9 version site:


but customer is not able to login to the site.

I tried in all browsers by clearing history. Also I checked in lot of systems. There also I am not able to login.

I followed this

Customer Login Doesn't Work in 1.9

but still customer can not able to login to the site.

  • 2
    Hi, I removed the credentials from your question. Please do not add user logins (frontend or backend) to any websites in questions or answers. – Anna Völkl Aug 26 '15 at 7:40
  • thanks @AnnaVölkl i iwill not do from next time..... – Baby in Magento Aug 26 '15 at 7:49
  • Just check if your time zone is set correctly. That could simply be the issue. – Maur Dec 6 '15 at 3:39
  • > The trick was to create the directory > app/code/local/Mage/Customer/Model and copy the file Session.php into > it. The Session.php file can be found at > app/code/core/Mage/Customer/Model. That helped me a lot! Nothing helped, but this! Thank you so much, I just created some folders, made the Session.php file copy into them, corrected it and it worked for me. Lots of thanks!! – anastasiya.s Mar 13 '18 at 15:48

There is issue in Cookie path and Cookie domain.

Cookie Path should be /

Cookie Domain should be hotwheelstoys.in/one/em0113-full-package

  • Mage.Cookies.path = '/';
  • Mage.Cookies.domain = '.hotwheelstoys.in/one/em0113-full-package';

This setting is managed from admin.

So go to Admin > System > Configuration > General > Web > Session Cookie Management for making required changes.

  • hi @amit , can you please explain what changes i have to do in what files ? – Baby in Magento Aug 26 '15 at 6:34
  • 3
    You dont need to touch any files. Amit is aking you to change the configurations. thats it. Backend config. – Sundar Aug 26 '15 at 7:26
  • 1
    Note to self: keep the domain entry blank on the dev machine facepalm – DM8 Feb 8 '18 at 16:31
  • not working.... – Sarfaraj Sipai May 9 '18 at 11:05

Looks like an issue with form-key

  1. Go to app/design/frontend/[Your-package]/[Your-theme]/template/customer/form/login.phtml and template/persistent/customer/form/login.phtml and under

  2. Find: <ul class=”form-list”>

  3. And paste this right after the code above the following:

    <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />

Repeat above for app/design/frontend/Your-package]/[Your-theme]/template/persistent/customer/form/login.phtml


You have to force Magento to use the same cookie domain in all cases. This solution was tested on Magento

When the Session Cookie Management variables are not set incorrectly Magento may create two "frontend" cookies with different cookie domains. This typically happens during the login process when you have HTTPS (ie. SSL enabled) for the secure URL. Here are workable values for the Session cookie management configuration.

Cookie Life Time: 3600
Cookie Path: /
Cookie Domain : .mydomain.com (The dot prefix is important)
Use HTTP Only : No
Cookie Restriction Mode: No 
  1. In the admin panel go to System -> Configuration -> Web-> Session Cookie Management
  2. Set the Cookie Management configuration as shown above
  3. Save the configuration and clear the Magento cache
  4. Restart your web server to clear the PHP variables in case you made the change directly in MYSQL database
  5. Clear your browser cache to remove any existing cookies associated with your magento site.

Using the dot prefix on the cookie domain is important to prevent duplicate cookies from being created for the secure URL

You can inspect your sites cookies using the developer tools in the FireFox or chrome browser.

Changing the cookie domain will also affect the "adminhtml" cookie used by the Magento back end. Make sure to clear your browser cache to prevent admin login problems.

  • Why not using "HTTP Only" ? It is flagged as unsafe by magento – DependencyHell Nov 14 '17 at 16:20
  • Setting "Use HTTP Only" to "No" lets you use the same cookie for secure and unsecure URLs. This is helpful during the checkout process when you allow HTTP for front end URLs. It avoids confusing the customer when they navigate through your site. – Stephen Fox Feb 5 '18 at 13:49
  • If you force all customers to use HTTPS then you can also change "Use HTTP Only" to "Yes" – Stephen Fox Feb 5 '18 at 13:59

100% solution

The trick was to create the directory app/code/local/Mage/Customer/Model and copy the file Session.php into it. The Session.php file can be found at app/code/core/Mage/Customer/Model. Once the file is moved over, find this section:

    public function setCustomerAsLoggedIn($customer)
    Mage::dispatchEvent('customer_login', array('customer'=>$customer));
    return $this;

Comment out the $this->renewSession( ); section, so it looks like this:

    public function setCustomerAsLoggedIn($customer)
    Mage::dispatchEvent('customer_login', array('customer'=>$customer));
    return $this;

Make sure to clear out all login cookies. I tested this on Chrome, Firefox, and IE on Windows, and Safari on iPad and everything worked like a charm.

  • till not working... – Sarfaraj Sipai May 9 '18 at 10:42
  • Its working on magento – Sourav Sep 9 '18 at 8:10

New answer to stale question:

Something went wrong with Google's Invisible reCaptcha today and some customers couldn't log in. This Q/A showed while I was searching on today's Magento customers cant order problem. Disabling invisible reCaptcha fixed the site.

If you find yourself here because customers can't log in, try a different browser (because cache and cookies can break login) and if the reCaptcha shows up needing its clicks, I suspect Google might be the problem.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.