Session and cookies Osc 2.3.4

[verticalhobby]

I am having some problems with Osc 2.3.4 and sessions or logins.

 

First of all, I had to put the "force cookies" setting true as some mobile devices couldn't log in.  Ie. I can log in with android tablet, but not with a android phone (shopping cart goes empty and login doesn't do anything).. I didn't find any pattern in this.. Some Ipad Safari's had the same problem.  Force cookies fixed this issue, but caused another problem.. Those apps that trying to set a session cookie, now throw user to the frontpage. Ie. some payment modules.  These again work fine when the force cookies is false (but then I have login issues with some specific browser / hardware combinations)...

 

I just updated from 2.2 to 2.3.4 and I didn't have this issue with the 2.2..  (I was using the force cookies use "true").  So with 2.2 the modules sessions worked ok..  I read that 2.3.4 did have some changes in the session handling.

 

Server is using PHP 5.6 (first I used PHP 5.5 version, I haven't tried if login problem is present with cookies off on 5.6, but I assume so), whereas with 2.2 I was using PHP 5.3.. I am using own SSL and the configurations settings should be correct for SSL and cookies (urls, paths etc.).  I've tried pretty much all the different settings, but can't have a state where everything works...  Same settings I am having now, worked fine on PHP 5.3 and Osc 2.2.

 

Anybody knows what is the cause of this and is there any configuration I am missing or some other fix ?  Or has someone else had similar problems ?   I haven't tried to work on the server settings yet as I am running on shared server, so I guess those are professionally set..  I am running on the same server, just updated the PHP version.

 

p.s. I am using SEO Urls 5 (different version than with 2.2), so that could also  mix something..

[♥kymation]

Try this: Set Force Cookie Use to false and also set Recreate Session to false.

 

Regards

Jim

[verticalhobby]

Thanks Jim, but I have tried that (tested again to be sure) and that doesn't help either..  If the force cookies use is false, it doesn't even try to login.. I tried with a wrong password and it won't even give error on that..

[verticalhobby]

I found articles about similar problems.. It seems that with some mobile devices the session id is changing for some reason, unless you use cookies.. Jim was on the right track, but I don't understand why the settings didn't help..

http://stackoverflow.com/questions/18213974/php-session-working-on-desktop-not-on-mobile

 

I tried to go thru the oscommerce sessions functions, but my understanding of the sessions is too low...  I thought changing the code to that, if the session id is not being held, then use cookies.. Then don't need to FORCE the use of cookies, but use those if the normal sessions fails (mobile devices etc.).  Having some payment module not working on a mobile device is not critical as there are other payment modules.. But then the login would work on all devices and payments on most.

[verticalhobby]

Here is our settings.. Is there anything I could change here to make these work  ?   Could it help, if I move the shop to the root ? We have our own SSL (not shared).

  define('HTTP_SERVER', 'http://www.verticalhobby.com');
  define('HTTPS_SERVER', 'https://www.verticalhobby.com');
  define('ENABLE_SSL', true);
  define('HTTP_COOKIE_DOMAIN', 'www.verticalhobby.com');
  define('HTTPS_COOKIE_DOMAIN', 'www.verticalhobby.com');
  define('HTTP_COOKIE_PATH', '/kauppa/');
  define('HTTPS_COOKIE_PATH', '/kauppa/');

 

Or is there anyone who has managed to get Osc 2.3.4 work on all browsers and platforms without the force cookie use true ?

[verticalhobby]

I think I solved it!.  I changed from session settings "Check SSL session ID" to true.. And now I can log at least with my android phone.. Need to check with customers who have had problems before too..  So now I don't need to force the cookies use.

[verticalhobby]

But no..  Now again won't work.. Maybe the mobile devices use cache so agressively that, they keep old sessions..  So that check SSL session Id helped once..

Ah, with another ID it worked.. So must be some session cache problem..  With another login just reloads the login page, without doing anything (except empying the shopping cart, if it had some contents before log in).

[gummipingvin]

We had same problem, I think its your cookie path, check the store cookies on ur device

[gummipingvin]

We had same problem, I think its your cookie path, check the store cookies on ur device

[mhsuffolk]

  define('HTTP_COOKIE_PATH', '/kauppa/');

  define('HTTPS_COOKIE_PATH', '/kauppa/');

 

 

 

What is the "kauppa" in your cookie path?

I am on a shared server with my own SSL, my cookie paths are set thus:

  define('HTTP_COOKIE_PATH', '/');

  define('HTTPS_COOKIE_PATH', '/');

 

I have:

Force cookies false

Check SSL session ID true

Recreate session true

 

Appers to work fine on all platforms for me.

 

Martin

[verticalhobby]

'kauppa' is the folder where oscommerce is installed.. I will try without it. But I found that login issues are solved on mobile devices, by clearing up the cache.. So I think it's the page cache that is causing the problems on these. 

[♥kymation]

Why are you using cache? It has very limited application. Most stores should leave it turned off.

 

Regards

Jim

[verticalhobby]

I meat that clearing up the cache on the mobile phone helps.  I am using oscommerce cache functions too, but I don't think those are the cause (and in our store it helps a lot. Lots of products, categories and orders).  It's that the devices keep old session info (cache), even when forcing the session recreate and check SSL session id..   Actually some customers who haven't visited our store for awhile, seem to have the same issue (even on PC).. So I guess they have the old session cache from 2.2 store.  I have just asked them to use a different browser or clear cache and that seems to do the trick..   So session cache seems to be the reason for this.   So I guess the problem will eventually go away once the sessions expire/cache is cleared..   Maybe if I move the store to the root will fix this ?

[verticalhobby]

This problem still didn't go away :(    Now we are still getting new customers who can't login with Mac Os..  If I put the force cookies use as true it works. So it was not just a cache problem, but something related to MacOs too..  Does anyone know what is so special about their session handling ?

[verticalhobby]

I think I solved it..  It was because of a missing image file.  It seems that Chrome browsers (at least on ipads and Mac Os) don't allow login session, if some element on page is not loading (well it works with cookies ok, so force cookies option will work).  So if someone else is having similar problems, check your links..  We had one manufacturer missing a image and that was causing the problem..