Suddenly losing Cart at login on shared ssl

[stevejebson]

Our shop (www.hitekhairtools.co.uk) has been running for a few months now but we have suddenly started getting problems at checkout. When arriving at the login.php on the shared ssl the cart has disappeared. Has anyone else experienced this problem.

 

thanks in advance

 

btw. novice php/mysql/oscommerce

[stevejebson]

also... here is my config.php which i have checked is the same on both servers

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.hitekhairtools.co.uk'); // eg, http://localhost - should not be empty for productive servers

 

 

define('HTTPS_SERVER', 'https://secure1.merchantservices.net/hitekh1/catalog/'); // !!!! this eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure? // !!!! this

define('HTTP_COOKIE_DOMAIN', 'http://www.hitekhairtools.co.uk');

define('HTTPS_COOKIE_DOMAIN', 'https://secure1.merchantservices.net/hitekh1/catalog/');

define('HTTP_COOKIE_PATH', '/catalog/');

define('HTTPS_COOKIE_PATH', '/catalog/'); // !!!! this

define('DIR_WS_HTTP_CATALOG', '/catalog/');

define('DIR_WS_HTTPS_CATALOG', '');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', 'c:/inetpub/wwwroot/PHP/hitek/catalog/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

// define our database connection

define('DB_SERVER', 'mysql-2.db.vi.net'); // eg, localhost - should not be empty for productive servers

define('DB_SERVER_USERNAME', 'hitekh');

define('DB_SERVER_PASSWORD', ' >_< ');

define('DB_DATABASE', 'hitekh');

define('USE_PCONNECT', 'false'); // use persistent connections?

define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'

 

// STS: ADD: Define Simple Template System files

define('STS_START_CAPTURE', DIR_WS_INCLUDES . 'sts_start_capture.php');

define('STS_STOP_CAPTURE', DIR_WS_INCLUDES . 'sts_stop_capture.php');

define('STS_RESTART_CAPTURE', DIR_WS_INCLUDES . 'sts_restart_capture.php');

define('STS_TEMPLATE_DIR', DIR_WS_INCLUDES . 'sts_templates/');

define('STS_DEFAULT_TEMPLATE', DIR_WS_INCLUDES . 'sts_template.html');

define('STS_DISPLAY_OUTPUT', DIR_WS_INCLUDES . 'sts_display_output.php');

define('STS_USER_CODE', DIR_WS_INCLUDES . 'sts_user_code.php');

// STS: EOADD

[stevejebson]

can anybody help me with this :(

[stevejebson]

am i missing something ? is there a reson why nobody replies ?

[OceanRanch]

Is it happening with all user's. If its only certain users then it may be a "cookie" or IP checking issue.

 

Go to your admin->configuration->sessions and check both cookie and "Check IP Address" settings.

 

Some ISP's will change address via their proxy servers when communicating via HTTPS. This would then cause a "new" session to be created if Check IP is true.

 

HTH

Tom

[Jad]

I think you have an error here:

 

define('HTTPS_COOKIE_DOMAIN', 'https://secure1.merchantservices.net/hitekh1/catalog/');

define('HTTPS_COOKIE_PATH', '/catalog/');

 

it should be like this:

 

'https://secure1.merchantservices.net');

define('HTTPS_COOKIE_PATH', '/hitekh1/catalog/');

 

Thats how I do it and it works for me.

[Guest]

Change

define('HTTPS_SERVER', 'https://secure1.merchantservices.net/hitekh1/catalog/');

to

define('HTTPS_SERVER', 'https://secure1.merchantservices.net/hitekh1');

Change

define('HTTP_COOKIE_DOMAIN', 'http://www.hitekhairtools.co.uk');
define('HTTPS_COOKIE_DOMAIN', 'https://secure1.merchantservices.net/hitekh1/catalog/');

to

define('HTTP_COOKIE_DOMAIN', 'www.hitekhairtools.co.uk');
define('HTTPS_COOKIE_DOMAIN', 'secure1.merchantservices.net/hitekh1');

 

 

Optional explaination on the loss of Session IDs: (in this case, using Shared SSL)

 

See the following code from catalog/includes/functions/html_output.php for more info. Pay attention to if (HTTP_COOKIE_DOMAIN != HTTPS_COOKIE_DOMAIN)

 

// Add the session ID when moving from different HTTP and HTTPS servers, or when SID is defined
   if ( ($add_session_id == true) && ($session_started == true) && (SESSION_FORCE_COOKIE_USE == 'False') ) {
     if (tep_not_null($SID)) {
       $_sid = $SID;
     } elseif ( ( ($request_type == 'NONSSL') && ($connection == 'SSL') && (ENABLE_SSL == true) ) || ( ($request_type == 'SSL') && ($connection == 'NONSSL') ) ) {
       if (HTTP_COOKIE_DOMAIN != HTTPS_COOKIE_DOMAIN) {
         $_sid = tep_session_name() . '=' . tep_session_id();
       }
     }
   }

[stevejebson]

Is it happening with all user's. If its only certain users then it may be a "cookie" or IP checking issue.

 

Go to your admin->configuration->sessions and check both cookie and "Check IP Address" settings.

 

Thanks Tom, I've checked my settings and they are all (force cookie usage, check user agent, check ip address, prevent spider & recreate session) set to false, is this correct ?

[Jad]

Hi again, I've been experimenting these last few days with dozens of configuration sets and I'd like to note that its infact better to put the URL of the catalog like this:

 

https://secure1.merchantservices.net/hitekh1/catalog

define('HTTPS_SERVER', 'secure1.merchantservices.net/hitekh1/catalog') and path be empty ''

 

instead of

https://secure1.merchantservices.net/hitekh1 (the rest with the path)

 

or this

https://secure1.merchantservices.net (the rest with the path)

 

and the idea is to keep the path like this '/' or '' , the reason is I tried through checkout and continue on all levels and it didn't give any error on the method of keeping the path of the catalog like this '/'. Whereas in the others it gave page cannot be diplayed. This happens usually when the SSL and nonSSL are on different domains, tried many times.

 

Let me know how things go and good luck

Jad

[OceanRanch]

Thanks Tom, I've checked my settings and they are all (force cookie usage, check user agent, check ip address, prevent spider & recreate session) set to false, is this correct ?

<{POST_SNAPBACK}>

I would leave all at false and set recreate session to true.

 

HTH

Tom