This is an article from NovusWeb: http://www.novusweb.com/fix-for-passing-magento-session-ids/
Fix for Passing Magento Session IDs
Author: Brett Williams
Posted November 9, 2011
Fixing Magento Session IDs
We often use shared SSL’s when building e-commerce sites. It’s a convenient way of hosting multiple stores without having to purchase separate SSL certificates for each site. Most of our e-commerce clients manage multiple stores within a single Magento or OpenCart installation. Recently, we found a problem with Magento where the customer’s session ID was not being passed successfully between their initial visit to the site and their page views after logging into the store as a registered customer. Magento was not passing the same session IDs, and this meant that a customer who had previously logged in and added items to their cart, would lose the contents of their cart after returning later and logging in. Not a great situation.
In looking at the cookies created during a session, I found that when going from an unsecure domain (i.e., http://) to a secure domain (i.e., https://), the session ID was being passed successfully and a new cookie for the secure domain was created with the same session ID as the unsecure domain. However, when the customer logged in, a new cookie was created for the secure domain with an entirely new session ID. Magento was now using the newer cookie, and whenever the customer clicked to go back into an unsecure domain page (e.g. product detail page), they were no longer logged into Magento as the unsecure domain was using its cookie/session ID, not the new session ID created at login. The solution would be to find where the new session ID was being created and prevent that from occurring.
So, I began digging into the code to see if I could find where Magento was creating the new session.
In app/code/core/Mage/Customer/Model/session.php, I found this at lines 177-189 (Magento CE 1.5.1):
public function login($username, $password)
{
/** @var $customer Mage_Customer_Model_Customer */
$customer = Mage::getModel('customer/customer')
->setWebsiteId(Mage::app()->getStore()->getWebsiteId());
if ($customer->authenticate($username, $password)) {
$this->setCustomerAsLoggedIn($customer);
$this->renewSession();
return true;
}
return false;
}
My solution was to comment out the line: $this->renewSession():, so that Magento would not create a new session when the customer logged in. The changed code looks like this:
public function login($username, $password)
{
/** @var $customer Mage_Customer_Model_Customer */
$customer = Mage::getModel('customer/customer')
->setWebsiteId(Mage::app()->getStore()->getWebsiteId());
if ($customer->authenticate($username, $password)) {
$this->setCustomerAsLoggedIn($customer);
//$this->renewSession();
return true;
}
return false;
}
So far in our testing, everything is working just fine, and the customer’s session is being retained between domains. Now, before you rush to change this core file, do the following:
Backup your databases (you should always do this before making any modifications).
Build the following directory hierarchy: app/code/local/Mage/Customer/Model/.
Put a copy of session.php into this new directory.
Comment out the appropriate line, shown above, and save your file.
By putting your modifications into the app/code/local directory, you’re telling Magento to use these files instead of the core files. More importantly, you’re preventing the loss of your modifications should you update Magento in the future.
It also provides a convenient way to store and manage your code modifications, as you only need to keep modified files in the app/code/local directory.
Be sure to leave a comment if you know of a more elegant solution, or if you find this works or doesn’t work for you.
I had the same problem...
The answer is that your theme does not supply a variable called form_key
.
Just as stated above I have to add:
<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />
you add it right after <ul class="form-list">
to each one of my login.phtml
files for the theme.
You may also have problems with updating the quantity of cart items
Here is the importance of form_keys
:
Since the beginning of time, Magento's backend contained a form key that protected against XSS attacks [1]. With Magento 1.8 the form key has entered the frontend for pretty much the same reason: to protect against form submission from another website, using your browser. a malicious attacker can add stuff to your cart while you're in a different browser tab or even complete an order for you. This relies on predictable URLs because the site will not have access to the actual HTML content in the browser tab where you have your Magento order waiting. Everything sent to the Magento store will however submit your cookies and thus use your session.
By adding a unique key to each form or to each link that generates action on the server, the URL or form content becomes no longer predictable. The form key is stored in the session data and validated upon submission to the server. If they don't match, you get a form key error and the action is not completed.
Best Answer
Make sure to setup your cookie domain name exactly same as how you access from browser(with or without www) And check the following settings in
And update like following
This should fix your problem(Clear your browser cookie for one last time and check)
If this doesn't work still your server environment and session/cookie saving doesn'tmatch like magento needed. So you may need to un-comment domain settings in
Around #95 from
To
Note:
You can extend this core file to your local and do this and you need to uncomment only the domain,secure,http params not entire cookie params.