MDVA-40311: Admin user gets an error message: Invalid security or form key
Admin user gets an error message: Invalid security or form key. Quality patch MDVA-40311 for magento/module-backend applies to Magento Open Source and Adobe Commerce 2.4.2-p2 to 2.4.3-p3.
- Categories
- Admin
- Components
- magento/module-backend
- Origin
- adobe-commerce-support
- Since QPT
- 1.1.7
Issue
Admin user gets an error message: Invalid security or form key. Please refresh the page, after login into the Admin if the custom admin path is configured and the secret key is enabled.
Steps to reproduce
* Log in as the Admin user using a valid username and password.
Adobe's page lists 2.4.2-p2 - 2.4.3-p1 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.
Adobe scheduled the permanent fix for 2.4.4.
Install
Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply MDVA-40311. On Cloud, add MDVA-40311 under stage.build.QUALITY_PATCHES in .magento.env.yaml.
For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its MDVA-40311/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.
Patch files and compatible versions
magento/magento2-base >=2.4.2-p2 <2.4.4
- Patch file
- patches/os/MDVA-40311_2.4.2-p2.patch
- vendor/magento/module-backend/App/Action/Plugin/Authentication.php
