Session Problem

[Guest]

Noticed a bug in my site. I log in and goto checkout. Then i get to checkout_shipping.php with session string. I remove the session key so it just shows ?osCsid=

 

Then hit enter. I am now officially a different registered customer. All info is someone elses now. The system is accessing a different customer_id now.

[AlanR]

If you're carrying the session id in the url your cookie setup is wrong.

[Guest]

If you're carrying the session id in the url your cookie setup is wrong.

<{POST_SNAPBACK}>

 

 

ok thanks what should i set these to on a shared server?

 

 

Session Directory = /tmp

Force Cookie Use = True

Check SSL Session ID = False

Check User Agent = False

Check IP Address = False

Prevent Spider Sessions = False

Recreate Session = False

Recreate Session = False

[Guest]

If you're carrying the session id in the url your cookie setup is wrong.

<{POST_SNAPBACK}>

 

 

It looks like I need to turn my SSL on and install my cert to force cookies to work?

 

Is this correct?