10

I meet a problem with magento 1.9.2.3, an error message appears when I connect with my custom admin form.

I created a module and I duplicated the customer/account/login page for my users role.

<?xml version="1.0"?> <config> <modules> <Custom_Page> <active>true</active> <codePool>local</codePool> </Custom_Page> </modules> </config>

my config.xml:

<?xml version="1.0"?> <config> <global> <page> <layouts> <Custom_Page> <label>User Login</label> <template>page/user_login.phtml</template> </Custom_Page> </layouts> </page> </global> </config>

No problem with old magento version.

But with 1.9.2.3: The Invalid Form Key. Please refresh the page appears.

NOTE: If I replace the old Observer.php it's done:

www\app\code\core\Mage\Admin\Model\Observer.php

But I think it's not serious to replace the new Observer.php with the old.

EDIT: My user_login.phtml contains an input form_key.

<form action="/admin" method="post" id="login-form"> <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>"/>

Thanks for your help.

Improve this question
3
  • which web browser did you use? Try using firefox because I was also getting this kind of error on Chrome. Commented Jan 29, 2016 at 10:46
  • I use Chrome but it's the same error with all web browser (Firefox, IE, Safari). Commented Jan 29, 2016 at 13:13
  • Can you please set "Cookie Domain" from system for making this thing correct. Commented Jul 28, 2016 at 16:50

14 Answers 14

Reset to default
27

I had the same problem and could fix it by setting the correct

web/cookie/cookie_domain

and

web/cookie/cookie_path

values in the table core_config_data.

Don't forget to clear all session and cookie data in your browser and the Magento session and cache files/data afterwards.

Improve this answer
2
  • 3
    So, what do I have to set in this entries? Commented Nov 5, 2017 at 7:16
  • what are the entries please? Commented Jan 8, 2019 at 8:44
12

I used these queries and could login again

DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain'; DELETE FROM core_config_data WHERE path='web/cookie/cookie_path';

and please make sure that webserver user has right to write to session storage. checking session_save_path setting if you save session to files. It looks like this

<session_save><![CDATA[files]]></session_save> <session_save_path><![CDATA[/tmp/session]]></session_save_path>

Improve this answer
2
  • nice way without the need for phpmyadmin, thanks :) Commented Jun 23, 2017 at 19:43
  • Nice! This solution works for me! Commented May 8, 2019 at 8:27
5

Newer versions of Magento require forms to have <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /> to prevent CSRF (Cross-Site Request Forgery) attacks.

Improve this answer
3
  • Yes, I have already add an input form_key in my form and this is the same result. Commented Jan 29, 2016 at 16:24
  • Can you confirm that the form key is actually getting generated? (check the page source). This problem occurred when you upgraded Magento? From what version? Commented Jan 29, 2016 at 20:50
  • I'm sure, when I go to check the source page: <input type="hidden" name="form_key" value="Pzty7ZxT6PWRSjhR"/> With magento 1.7.0.2 it's ok. Commented Jan 29, 2016 at 22:06
5

Check your settings for https. If you use httpsfor your magento but trying open site with http you will have this a problem.

Improve this answer
2
  • 1
    change config web/secure/use_in_adminhtml to 0 in that case Commented Oct 19, 2017 at 18:00
  • Thank you, @roman204, that was driving me crazy! I was so sure this setting just meant "use whatever is defined in secure base url" but apparently not, it tries to enforce https regardless. After almost a decade working with the blessed thing, I still hadn't encountered this quirk until now. Magento, the gift that just keeps giving :D :D Commented Mar 15, 2018 at 0:21
5

I got this error after upgrading to php7.0. running magento enterprise 1.9. I then tried every suggestion out there. Here is how I got it to work:

  1. I added error reporting in my index.php, and fixed all the errors being reported.

  2. In MySQL table core_config_data, I cleared values for web/cookie_path web/cookie_httponly. Make sure you have the right web/cookie_domain value with your domain (very important).

  3. Clear your browser cache and cookies.

Improve this answer
3

I had the same error with Magento 1.9.2.3 after copying site on local web server on MAMP 3.

So, problem resolved when I changed in table core_config_data the web/cookie/cookie_domain to mysite.lan instead of the mysite.lan:8888 .

Improve this answer
2

In my case this was working on Linux but on my local windows environment using virtualbox/Docker and windows 10 this error was caused by the weird permissions that vb/docker/windows gives to /var/sessions/. On my local development environment only I moved the path from a mapped windows drive to a "real" path on the linux VM

I added this to the config file app/etc/local.xml, then deleted all files in var/cache and var/session and could login OK.

<session_save><![CDATA[files]]></session_save> <session_save_path><![CDATA[/tmp]]></session_save_path>
Improve this answer
2

In my case I created the error with this steps: I had moved a magento copy (dev) in the magento itself: magento/magento-copy Before, they where next to each other on the server. Everyone with his own quota. So moving one qutoa into the other -> problems occured. Cause I could not view the magento-copy with FTP I changed the owner of the files by file-editor. For any reason this created the error.

Improve this answer
1

Check if you can login on https://yourwebsite/admin instead http and check core_config_data web/secure/use_in_adminhtml

i've got similar problem and login works only on secure

Improve this answer
1

I often get this problem when I am working on several development sites and live sites, and there is some cookie confusion. Previously I've fixed it with MySQL queries and deleting files but I have found a neater way to solve the problem.

The magerun tool provides a way to check for problems with the cookie path and to fixe them. magerun isn't a part of Magento, so you will need to install it. It is described as a swiss-army-knife for magento, so you could find it useful for other things.

To download it:

wget https://files.magerun.net/n98-magerun.phar

Then

chmod +x n98-magerun.phar

Then check the cookie path for problems...

./n98-magerun.phar config:get web/cookie/*

It will print a table. Look at the value for web/cookie/cookie_domain. When I am having this problem it does not match the proper hostname for the site (e.g. I get dev.example.com instead of www.example.com).

To fix it you need to reset the path and flush the cache, which magerun can help with...

./n98-magerun.phar config:set web/cookie/cookie_domain "" ./n98-magerun.phar cache:flush

You should then be able to log in again.

Improve this answer
1

Regarding the accepted answer ( https://magento.stackexchange.com/a/102678/6078 ) the correct entries are

web/cookie/cookie_domain = your base url like:

https://website.com/ (without any store code)

and

web/cookie/cookie_path

typically just / but can be /[storecode]/ also per store

For local development it usually works to delete cookie_domain or leave it empty but it seems like Microsoft Edge 80 has issues with that.

Improve this answer
0

My problem was php version 7.2 .

change my php version for 5.6 in .htaccess

AddHandler application/x-httpd-php56 .php suPHP_ConfigPath /opt/php56/lib

Improve this answer
0

Another way this error can happen for homemade admin modules is when frontName in your routes.xml doesn't match the <add action"someFrontName/someAction" /> in your menu.xml. This causes the key you see in the link when trying to open the module to be different than expected.

Improve this answer
0

After copying your magento 1 site to a new domain, Varien.php may still have the old domain name in the file.

To ensure your admin form is using the new 'cookie domain, update any references to your old domain in the Varien.php file located in your site at:

/<magento_html_dir>/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

After making the edits, run a cache flush/clean, and reindex all (n98-magerun tool is good for this): Example:

n98-magerun cache:clean n98-magerun cache:flush n98-magerun index:reindex:all
Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.