Magento only accepts form submissions on the storefront if they contain a valid form key, a security token that protects against forged requests. Forms that are written directly into the content of a CMS page or block, for example a small contact or sign-up form, have no way to include this key, so Magento rejects them. This module adds a widget that inserts the key into such forms.
Features
- New widget “CMS Form Key” (“Adds a hidden input field with the current form key.”) in the widget selection of the content editor.
- Place the widget inside the form in your CMS content. It outputs a hidden field with the form key of the current visitor.
- Pages that contain the widget are sent with headers that prevent caching in the browser, so each visitor gets a valid key.
Configuration
There are no settings. Insert the widget with “Insert Widget” in the editor of a CMS page or block, between the opening and closing tag of your form. The widget has no options.
Good to know
The widget only adds the form key. The form itself, including its target address and fields, has to be written in the CMS content.
Installation
Install the module with Composer in your Magento root directory:
composer require infrangible/m2-cms-form-keyThen enable it and update the store as described in the installation guide. Composer installs the required modules listed on this page automatically.