A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
49

It also happens if the cookie domain in System > Configuration > Web > Cookies is different from the actual site domain. To remove the setting without access to the admin panel: use the following SQL query on the MySQL console or in a client like phpMyAdmin: DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain'; clear the cache. If you are ...


43

Form keys in Magento are a means of preventing against Cross Site Request Forgery - explained brilliantly by Ashley Schroder here but, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you. This can be dangerous because someone could theoretically create their own form and post to any form ...


27

I had the same problem and could fix it by setting the correct web/cookie/cookie_domain and web/cookie/cookie_path values in the table core_config_data. Don't forget to clear all session and cookie data in your browser and the Magento session and cache files/data afterwards.


23

Form keys in Magento are a means of preventing against Cross Site Request Forgery, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you. This can be dangerous because someone could theoretically create their own form and post to any form handler controller action in your store. CSRF ...


21

The patch adds a new form key to app/design/frontend/base/default/template/customer/form/register.phtml and to app/design/frontend/base/default/template/persistent/customer/form/register.phtml If your theme overrides these, simply add - <?php echo $this->getBlockHtml('formkey'); ?> right after this line - <form action="<?php echo $...


20

You can add formkey by this code: <?php $objectManager = \Magento\Framework\App\ObjectManager::getInstance(); $FormKey = $objectManager->get('Magento\Framework\Data\Form\FormKey'); ?> //Hidden form key field after <form> tag <input name="form_key" type="hidden" value="<?php echo $FormKey->getFormKey();?>"> If you want to ...


18

I am posting the question / answer because I couldn't find anything relevant. The issue was that the drive on which my magento installation resides was full. I freed up some room, clear the /var/session and /var/cache and everything went back to normal.


17

Probably nothing because the form key is random, so it has to be different each time. So it should not make a difference, but the best practice, how you should add the form key input to your template, is this: <?php echo $this->getBlockHtml('formkey') ?> Update: I have to admit, I was wrong in one point: The form key stays the same during a ...


14

Try following way: protected $formKeyValidator; public function __construct ( \Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator ) { $this->formKeyValidator = $formKeyValidator; } And then if (!$this->formKeyValidator->validate($this->getRequest())) { // invalid request }


11

This is how I solved it eventually, add the following methods to the block in question: const FORM_KEY_PLACEHOLDER = '{{FORM_KEY}}'; protected function _toHtml() { return $this->_insertFormKeyPlaceholder(parent::_toHtml()); } protected function _afterToHtml($html) { return $this->_restoreFormKey(parent::_afterToHtml($html)); } protected ...


11

I used these queries and could login again DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain'; DELETE FROM core_config_data WHERE path='web/cookie/cookie_path'; and please make sure that webserver user has right to write to session storage. checking session_save_path setting if you save session to files. It looks like this <session_save&...


10

It prevents Cross Site Request Forgery Cross-Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. ...


9

Pass form_key: For Validate form key ,you need to send the form key with URL or as a hidden input. If you send as URL parameter then the parameter name should be form_key/[keyValue]. If send as hidden field then you need to send as <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /&...


8

I know this vague question should not be answered. However I might have run into a similar issue here, this is what I have learned: the form_key must not be different in each request the form_key is consistent throughout the session a different session should create a different form_key (try another browser) the PAGE CACHE does sometimes interfere with ...


7

Form keys in Magento are a means of preventing against Cross Site Request Forgery, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you. This can be dangerous because someone could theoretically create their own form and post to any form handler controller action in your store. CSRF ...


6

Form key validation in Magento Connect has been added in SUPEE-6285. The form key input has been added to the following templates in /downloader: downloader/template/connect/packages.phtml downloader/template/connect/packages_prepare.phtml downloader/template/login.phtml downloader/template/settings.phtml Since you obviously get requests to the downloader ...


6

You have two options, Disable form keys for the remove action. There is no real risk in doing this, the CSRF protection the form keys add have limited scope for damage when removed on cart actions. You could use this module as a basis if you wanted to script something Change the remove link to use getUrl('checkout/cart/ajaxDelete', array(..., ...


6

I had the same problem and this solution saved my day! Go to: app/design/frontend/base/default/template/customer/form/register.phtml and app/design/frontend/base/default/template/persistent/customer/form/register.phtml Add this line of code: <?php echo $this->getBlockHtml('formkey'); ?> after <form action="<?php echo $this->...


5

Check your settings for https. If you use httpsfor your magento but trying open site with http you will have this a problem.


5

I got this error after upgrading to php7.0. running magento enterprise 1.9. I then tried every suggestion out there. Here is how I got it to work: I added error reporting in my index.php, and fixed all the errors being reported. In MySQL table core_config_data, I cleared values for web/cookie_path web/cookie_httponly. Make sure you have the right ...


4

Turns out that it was merging my files with the Fooman extension. I restored my installation to a day before installing the extension and the problem is gone. Thank you Natalie for the nudge in the right direction. What I have done instead is pretty great I think, and something I'd like to mention here for others in the future. I installed Fishpig's ...


4

You can create a function in one of your javascript files like this: function savePackage(){ disableElements('save'); if (editForm.submit() == false){ enableElements('save'); } varienGlobalEvents.attachEventHandler('formValidateAjaxComplete', function (){ enableElements('save'); }); } Then, in your Edit.php block for ...


4

Newer versions of Magento require forms to have <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> to prevent CSRF (Cross-Site Request Forgery) attacks.


4

If you want to use js in external file then you need to add below code in any top of head.phtml file var formKey = "<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>"; Then add your js code as below: jQuery.ajax({ url: "/package/module/index/index", type: "POST", data: {form_key:formKey name: user_name, dob: ...


4

What I did to fix the issue is that I went to this file: /vendor/magento/module-customer/Model/Plugin/CustomerFlushFormKey.php and, on line 48 with the ff. codes: if ($beforeParams['form_key'] == $currentFormKey) {....} I added a checker for the $beforeParams['form_key']: if (!empty($beforeParams['form_key']) && $beforeParams['form_key'] ...


4

Finally I got the solution I have a custom payment method that uses the cc-form to take credit card payments with and without 3dsecure. After placing order with 3dsecure, I am re-directing to 3dsecure page as normal, but on returning from 3dsecure, I am re-directed to the home page with "Invalid Form Key. Please refresh the page why because in Magento 2.3 ...


3

Seems like you put an error in the template: The URL should be /customer/account/createPost (capital P)


3

For me the problem was related to having taken off the remove class from the remove button. You either need to revert this change or change the selector in skin/frontend/<rwd>/default/js/minicart.js on line 32 to correctly target your remove button.


3

Presumably that's because the visitor's session expired. The form key is tied to the session. When they submit the form, Magento sees they have no valid session, and so creates a new one (along with a new form key). That new key doesn't match the one submitted, so they get an error--but submitting again immediately after that failure would indeed work. ...


3

I had the same error with Magento 1.9.2.3 after copying site on local web server on MAMP 3. So, problem resolved when I changed in table core_config_data the web/cookie/cookie_domain to mysite.lan instead of the mysite.lan:8888 .


Only top voted, non community-wiki answers of a minimum length are eligible