Magento admin panel invalid form key

A very frustrating problem is a invalid form key error message on your admin panel login page. This is very hard to find out if you do not know adminhtml settings. Often the only solution is to manipulate your Magento database…here is all you need to know.

Magento admin panel invalid form key

You may know the problem: You want to login into your Magento 1 adminhtml, but you are redirected to login with an error message: “Invalid Form Key. Please refresh the page.“. If you are a Magento developer you may know form key problems from previous patches. Each form needs a generated form key, so it is not possible for an attacker to send various post data for Magento 1 forms. This is also true for your backend login. The solution is quite easy, but not obvious…

Solution

For a solution you need to do the following two points:

• delete cookie domain from database
  
  DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain';

  1	DELETE FROM core_config_data WHERE path='web/cookie/cookie_domain';

• flush cache
  
  rm -rf var/cache/*

  1	rm -rf var/cache/*

If you reload your login page, you should now login without a problem.

Possible wrong paths

Beside this simple solution, your approaches as developer may be different. The message suggests a problem with form keys. So the first attempt would be to check form html code with your preffered web developer tool:

You will see, that a form key is set. Next would be a check if this key was generated correctly and what exactly happens in your frontend controller. A common problem will be a wrong form key validation, but for this you need to debug Magento core files. We already know, that this is not the problem. If you debug this, you may spend hours to find out, that everything works as expected.

Conclusion

A wrong admin panel form key validation is caused by a cookie domain which is different to your domain. A common problem if you copy a shop db to a development environment or to a new domain.