8

I meet a problem with magento 1.9.2.3, an error message appears when I connect with my custom admin form.

I created a module and I duplicated the customer/account/login page for my users role.

<?xml version="1.0"?>
<config>
    <modules>
        <Custom_Page>
            <active>true</active>
            <codePool>local</codePool>
        </Custom_Page>
    </modules>
</config>

my config.xml:

<?xml version="1.0"?>
<config>
    <global>
        <page>
            <layouts>
                <Custom_Page>
                    <label>User Login</label>
                    <template>page/user_login.phtml</template>
                </Custom_Page>
            </layouts>
        </page>
    </global>
</config>

No problem with old magento version.

But with 1.9.2.3: The Invalid Form Key. Please refresh the page appears.

NOTE: If I replace the old Observer.php it's done:

www\app\code\core\Mage\Admin\Model\Observer.php

But I think it's not serious to replace the new Observer.php with the old.

EDIT: My user_login.phtml contains an input form_key.

<form action="/admin" method="post" id="login-form">
    <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>"/>

Thanks for your help.

  • which web browser did you use? Try using firefox because I was also getting this kind of error on Chrome. – Fayyaz Khattak Jan 29 '16 at 10:46
  • I use Chrome but it's the same error with all web browser (Firefox, IE, Safari). – phpschool Jan 29 '16 at 13:13
  • Can you please set "Cookie Domain" from system for making this thing correct. – Ketan Panchal Jul 28 '16 at 16:50

11 Answers 11

27

I had the same problem and could fix it by setting the correct

web/cookie/cookie_domain

and

web/cookie/cookie_path

values in the table core_config_data.

Don't forget to clear all session and cookie data in your browser and the Magento session and cache files/data afterwards.

  • 3
    So, what do I have to set in this entries? – Alejandro del Río Nov 5 '17 at 7:16
  • what are the entries please? – Zoya Jan 8 at 8:44
11

I used these queries and could login again

DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain'; DELETE FROM core_config_data WHERE path='web/cookie/cookie_path';

and please make sure that webserver user has right to write to session storage. checking session_save_path setting if you save session to files. It looks like this

<session_save><![CDATA[files]]></session_save> <session_save_path><![CDATA[/tmp/session]]></session_save_path>

  • nice way without the need for phpmyadmin, thanks :) – acidjunk Jun 23 '17 at 19:43
  • Nice! This solution works for me! – Marc May 8 at 8:27
5

Check your settings for https. If you use httpsfor your magento but trying open site with http you will have this a problem.

  • 1
    change config web/secure/use_in_adminhtml to 0 in that case – roman204 Oct 19 '17 at 18:00
  • Thank you, @roman204, that was driving me crazy! I was so sure this setting just meant "use whatever is defined in secure base url" but apparently not, it tries to enforce https regardless. After almost a decade working with the blessed thing, I still hadn't encountered this quirk until now. Magento, the gift that just keeps giving :D :D – Doug McLean Mar 15 '18 at 0:21
5

I got this error after upgrading to php7.0. running magento enterprise 1.9. I then tried every suggestion out there. Here is how I got it to work:

  1. I added error reporting in my index.php, and fixed all the errors being reported.

  2. In MySQL table core_config_data, I cleared values for web/cookie_path web/cookie_httponly. Make sure you have the right web/cookie_domain value with your domain (very important).

  3. Clear your browser cache and cookies.

4

Newer versions of Magento require forms to have <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> to prevent CSRF (Cross-Site Request Forgery) attacks.

  • Yes, I have already add an input form_key in my form and this is the same result. – phpschool Jan 29 '16 at 16:24
  • Can you confirm that the form key is actually getting generated? (check the page source). This problem occurred when you upgraded Magento? From what version? – andyjv Jan 29 '16 at 20:50
  • I'm sure, when I go to check the source page: <input type="hidden" name="form_key" value="Pzty7ZxT6PWRSjhR"/> With magento 1.7.0.2 it's ok. – phpschool Jan 29 '16 at 22:06
3

I had the same error with Magento 1.9.2.3 after copying site on local web server on MAMP 3.

So, problem resolved when I changed in table core_config_data the web/cookie/cookie_domain to mysite.lan instead of the mysite.lan:8888 .

2

In my case this was working on Linux but on my local windows environment using virtualbox/Docker and windows 10 this error was caused by the weird permissions that vb/docker/windows gives to /var/sessions/. On my local development environment only I moved the path from a mapped windows drive to a "real" path on the linux VM

I added this to the config file app/etc/local.xml, then deleted all files in var/cache and var/session and could login OK.

<session_save><![CDATA[files]]></session_save>
<session_save_path><![CDATA[/tmp]]></session_save_path>
2

In my case I created the error with this steps: I had moved a magento copy (dev) in the magento itself: magento/magento-copy Before, they where next to each other on the server. Everyone with his own quota. So moving one qutoa into the other -> problems occured. Cause I could not view the magento-copy with FTP I changed the owner of the files by file-editor. For any reason this created the error.

1

Check if you can login on https://yourwebsite/admin instead http and check core_config_data web/secure/use_in_adminhtml

i've got similar problem and login works only on secure

1

I often get this problem when I am working on several development sites and live sites, and there is some cookie confusion. Previously I've fixed it with MySQL queries and deleting files but I have found a neater way to solve the problem.

The magerun tool provides a way to check for problems with the cookie path and to fixe them. magerun isn't a part of Magento, so you will need to install it. It is described as a swiss-army-knife for magento, so you could find it useful for other things.

To download it:

wget https://files.magerun.net/n98-magerun.phar

Then

chmod +x n98-magerun.phar

Then check the cookie path for problems...

./n98-magerun.phar config:get web/cookie/*

It will print a table. Look at the value for web/cookie/cookie_domain. When I am having this problem it does not match the proper hostname for the site (e.g. I get dev.example.com instead of www.example.com).

To fix it you need to reset the path and flush the cache, which magerun can help with...

./n98-magerun.phar config:set web/cookie/cookie_domain ""
./n98-magerun.phar cache:flush

You should then be able to log in again.

0

My problem was php version 7.2 .

change my php version for 5.6 in .htaccess

AddHandler application/x-httpd-php56 .php suPHP_ConfigPath /opt/php56/lib

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.