After new magento 1.9 installation when I am login to the admin panel there is a fine flow.
After that if I am opening admin panel on other tab like:
www.example.com/admin
It is showing error on dashboard
Invalid Secret Key. Please refresh the page.
- First of all enable formkey validation. Then check web/cookie/cookie_domain and web/cookie/cookie_path to either be correct or emptyYiorgos Moschovitis– Yiorgos Moschovitis2017-10-24 08:03:11 +00:00Commented Oct 24, 2017 at 8:03
- formkey validation is enabled. web/cookie/cookie_domain set to mydomain.com web/cookie/cookie_path set to / But still facing errorShoaib Munir– Shoaib Munir2017-10-24 10:11:35 +00:00Commented Oct 24, 2017 at 10:11
- 1Can you post the settings you have at General/Web/Session Cookie Management and General/Web/Session Validation Settings ?Yiorgos Moschovitis– Yiorgos Moschovitis2017-10-24 14:02:30 +00:00Commented Oct 24, 2017 at 14:02
- Here it is: screencast.com/t/GdRnK2ucNM please ignore example.com, I have changed it just for demoShoaib Munir– Shoaib Munir2017-10-25 05:23:53 +00:00Commented Oct 25, 2017 at 5:23
- Use HTTP Only = No is a security risk. I'd reccomend you changed it back on. This is still probably a cookie issue. Have you tried logging in from another browser or computer?Yiorgos Moschovitis– Yiorgos Moschovitis2017-10-25 09:48:34 +00:00Commented Oct 25, 2017 at 9:48
| Show 3 more comments
1 Answer
I had this issue on EE 1.14, and was provided SUPEE-10358 to fix (which it did!).
The patch updates one line in app/code/core/Mage/Adminhtml/Controller/Action.php
In the preDispatch() method, replace if ($_keyErrorMsg != ''){ with if (!$_isValidFormKey) { (around line 189).
I haven't tried it yet in CE, but Action.php is the same in CE 1.9, so I'm hoping this same patch will do the trick.
