customer login problems

i've been having customers report login problems lately - orders are still coming in so it's not everyone, but particularly those customers using AOL's browser are not able to login. they are continually redirected to the login page. sometimes they are able to login later, using explorer or firefox.

just got an email from someone using the MSN browser, having the same login problem.

i'm also getting reports about people changing their password, and then their new password doesn't work.

my site is at http://oyinhandmade.com/oyin

can anyone help shed light on this issue??

I am having the same problem, something with the session management
since registered users are booted right back to the login page after
supplying a valid username and password. (Which also means that
checkouts aren't available.)

I've gone back to stock installations of both 1.2.7 and 1.3.x on the
same server to try and pinpoint the problem. It happens in 1.3.0 and
1.3.0.1 but not 1.2.7.

The details reported by the 'Server / Version Info' page in admin are
value-for-value identical with the exception of the installation
paths.

Installation Details:
(Same server and environment for both installations)

- Server OS: Linux 2.6.15-1.2054_FC5smp
- Database: MySQL 5.0.18
- PHP Version: 5.1.2 (Zend: 2.1.0)
- HTTP Server: Apache/2.2.0 (Fedora)

I've tried these browsers:

- Firefox 1.5.0.3
- IE 6.0.2900.2180.xpsp_sp2_gdr.050301-1519
- Mozilla 1.7.13

If anyone has any insight I'd appreciate it, as I'm new to ZenCart, and
in particular to session management with PHP.

[ Possibly the same problem as described in the following recent
(archived but unresolved) thread:
http://www.zen-cart.com/forum/showthread.php?t=34926 ]

--
Steven Wood
Ikoro Digital Inc

Quote:

---

Originally Posted by exittheapple

i've been having customers report login problems lately - orders are still coming in so it's not everyone, but particularly those customers using AOL's browser are not able to login. they are continually redirected to the login page. sometimes they are able to login later, using explorer or firefox.

just got an email from someone using the MSN browser, having the same login problem.

i'm also getting reports about people changing their password, and then their new password doesn't work.

my site is at http://oyinhandmade.com/oyin

can anyone help shed light on this issue??

---

Your shop appears to be working ... I was able to add to cart, create an account, logout, login and checkout without any problems ...

Were you able to resolve this?

If not, what are your settings in the Session Settings?

sdwood, what is the URL where you are having these issues?

What are your current Session Settings?

Do you store your sessions in the database or file? If in file, set to the database and see if that makes a difference ...

Hello Linda,

Your reply to exittheapple gave me the clue I needed. It seems the
default session configurations for the 1.2.7 and 1.3.x versions are
not the same. 'Recreate Session' defaults to 'false' in 1.2.7 but
'true' in 1.3.x. Switching this to 'false' in 1.3.x resolved the
issue. FWIW, my sessions are stored in the DB.

Thanks for the quick reply!

--
Steven Wood
Ikoro Digital Inc

Quote:

---

Originally Posted by Ajeh

Your shop appears to be working ... I was able to add to cart, create an account, logout, login and checkout without any problems ...

Were you able to resolve this?

If not, what are your settings in the Session Settings?

---

thanks for the replies! the strange thing is, i am able to add to cart, create account, login, checkout, etc also! i use a mac and firefox or safari. i was only able to recreate the problem when i tried from a friend's PC using aol's browswer. (when i used explorer on his computer, i could use the cart fine)

i believe this problem also reared its head during the upgrade from 1.2.7

'recreate sessions' is set to false; and sadly i have to admit i don't know too much about what the other session settings mean. here they are:

Quote:

---

Session Directory /home/mysite/public_html/oyin/cache
Cookie Domain - True
Force Cookie Use - False
Check SSL Session ID - False
Check User Agent - True
Check IP Address - True
Prevent Spider Sessions - True
Recreate Session - False
IP to Host Conversion Status - True

---

bumping... crossing fingers that someone can help

These are the defaults for v1.3.x ...

Quote:

---

Title Value Action
Session Directory /home/your_username/public_html/your_catalog_dir/cache
Cookie Domain True
Force Cookie Use False
Check SSL Session ID False
Check User Agent False
Check IP Address False
Prevent Spider Sessions True
Recreate Session True
IP to Host Conversion Status true

---

thank you, Ajeh - i'll try setting the 'user agent' and IP validation settings to false and have my customers with issues test again.

I just put recreate session back onto true, and now since I have upgraded, i believe it is working.

Your help has been much appreciated though !

I have the same problems, i can login if i using Internet Explorer, but i can not if i using Firefox.

In what file u findeing this session settings. Need answer, thanks.

www.electro.electronetto.se not finish design yet

Peter

I operate a relatively large store based on the Zen-Cart source and have noticed this same problem appear in the last few days. It really has be stumped.

Most customers have no problems, but in the last 5 days 10-20 customers have reported that they cannot log-in, after entering the information it just returns them to the login page. What's worse, I can't reproduce the problem, it works just fine for me and the rest of the staff.

I suspect browser compatibility issues, but have no confirmation on what browsers are being used by those experiencing this issue.

I will provide the site address upon request, here's the system info:

Sessions:
Session Dir: blahblah/htdocs/shop/cache
Cookie Domain: True
Force Cookie Use: True
Check SSL Session ID: True
Check User Agent: False
Check IP Address: True
Prevent Spider Sessions: True
Recreate Session: False

Zen-Cart v1.2.4.1 (with lots of modification, but none regarding logins in the last week)
MySQL v4.1.18
PHP v5.1.1 (session_save - files)
Apache 1.3.34
Everything is running on SPARC-Solaris

Have any browsers updated anything recently that would affect session behavior? (Like AOL maybe?)

Any ideas are appriciated. Thanks.

Try turning off the Forced Cookies ... then check and see if this resolves the problem ...

Note: might need to delete the existing cookie(s) to test this with someone who experienced this issue ...

I have assumed that would solve the issue, but I need another solution. We used to have "force cookies" disabled but we were having the typical problem where orders got switched around and customers received e-mails from orders they didn't make. So, that's out of the question.

Besides, if they have cookies disabled when logging in they should get the cookie warning page, right? Why would that not happen? (Again, browser compatability?)

I've started logging customer IP-Browser pairs (with HTTP_USER_AGENT) as soon as I get a few more complaints and match the IPs I will post the results from that.

Quote:

---

PHP v5.1.1 (session_save - files)

---

If you are using SSL for logins, you would be far safer using the database to store your sessions, not the filesystem.

May I ask why?

The webserver handles SSL and NONSSL activities as separate activities from separate sites. This runs the risk of having your session data not available if the filesystem references aren't available from the "other" site.
Granted, if all the files are handled from the same place, the risk is limited.
However, if it's all stored in the database, it's all available regardless of which server it's coming from.
Further, having any security information left in O/S files is a sensitive issue to many.
Also, files are vulnerable to changes made server administrators related to permissions. If 777 rights were ever prevented by the admin, your site would be down until the sessions files could be written again.

Both options work, but I recommend database for almost all cases.

And once again I am having the same problem. Users cannot login on www.diamonds2buy.com for no apparent reason. Recreate session on, off whatever. Doesnt seem to like me.

I eventually resolved the problem, though am not sure exactly what it was that I changed to do so. As suggested, I moved to DB sessions. I also removed an image that was loading from another domain, causing the login page to throw a security warning about secure/nonsecure elements (in IE... because IE is dumb).
One of the two resolved it, probably the DB sessions.

Note: FireFox is just as unhappy about non-secure images on secure pages ... it just doesn't scream about it ... and shows the broken lock instead of the warning and no lock the way IE does it ...

Either way ... non-secure images on a secure page isn't really very secure ... :blink:

Quote:

---

Originally Posted by magicmarc

And once again I am having the same problem. Users cannot login on www.diamonds2buy.com for no apparent reason. Recreate session on, off whatever. Doesnt seem to like me.

---

NOTE: you allow the US to create accounts but there isn't a place for the State ...

I could create an account and did not get errors but you have your secure turned off ...

Apparently i'm having this same issue. I've gotten some messages from people using AOL for their ISP with that ###### aol browser. with Aol Explorer it works fine, firefox fine, IE fine.

www.allpaintballsupplies.com

i just turned the recreate sessions to false hopefully that'll get it working.

I'm getting these problems also. It's occuring from Firefox, IE, etc. Whenever I have 'recreate sessions' set to TRUE. Which of course I'd prefer or I'll get those copied sessions ids that cause problems. What the heck happened. I recently upgraded a couple weeks ago to 1.3.0.2 and didn't notice any problems, but I'm now seeing it occur. Couldn't be all the time though as I've still had orders coming in. Something very strange...could we all have the same host provider? I'm using OSH right now.

Okay. Just found the problem. I added some affiliate banners today through Banner Manager. Why would this cause a problem like login failure? I don't quite get it, so maybe someone can help me out. I can send you my Banner code through PM. Not sure if I should post it or not...if some kind of rule against posting the code that is.

There could be numerous reasons why a contribution module could affect a core feature actually. Are you sure it's fully compatible with the latest version of Zen-Cart ? Perhaps the contribution has been created for older versions of Zen-Cart.

Quote:

---

Originally Posted by TheOracle

There could be numerous reasons why a contribution module could affect a core feature actually. Are you sure it's fully compatible with the latest version of Zen-Cart ? Perhaps the contribution has been created for older versions of Zen-Cart.

---

I didn't add any modules. I just put some affiliate code in a banner using the built-in banner manager. Nothing funny I see about the code, but something causes the login problems in it.

i've added some code to a few pages for adwords campaign reasons, but i wouldn't think that's the issue.

My host is hostgator.com
the only ISP that has problems with my website is AOL Security Edition.

Aol Explorer, IE, and Firefox all work fine for me.

www.allpaintballsupplies.com

aol users go to my website and it asks them to login/register, you type in your info and it goes back to the page to fill out to login/register. we really need to fix this because AOL is such a big ISP someone let me know what i need to do.

Quote:

---

AOL is such a big ISP someone let me know what i need to do.

---

In which sense ? :happy:

Quote:

---

I didn't add any modules. I just put some affiliate code in a banner using the built-in banner manager. Nothing funny I see about the code, but something causes the login problems in it.

---

If this isn't any downloaded contributions from the forum, how about PMing me the codings (if it's not too large due to limited characters limit on the forum). Is it PHP ? If it's JS script codings, I'm not quite the expert on this one though.

lotsa people use AOL, i'm not saying it's my isp of choice. and i don't know why people that have aol use the aol browser instead of IE you got me?

i just turned recreate sessions to false...which supposedly fixes some of the problems. to do so go to:
Configuration>Sessions>Recreate Session>False

yeah apparently setting that to false makes things work better in my trial version of AOL. i can go view products and see pricing before logging in now, and i can also now sign in...score one for turning recreate sessions to false

Quote:

---

Originally Posted by anjordan77

yeah apparently setting that to false makes things work better in my trial version of AOL. i can go view products and see pricing before logging in now, and i can also now sign in...score one for turning recreate sessions to false

---

Only bad thing about this is that...someone tell me if I'm wrong...is that if someone copies and pastes, or a crawler grabs a URL that has the session id in the code...multiple people could connect at the same time and see some of each others information.

TheOracle....PMd you the code. Looks strictly HTML to me, but something is causing problems. Maybe it's a certain character combination or something...not really sure. It's easily reproducible to me though. I could check again tomorrow, but I was reproducing the login issue with 2-3 different pieces of HTML affiliate code...where as others were allowing login. Very strange...

Thanks for posting the solution on this problem. :wink2:

What the hell ?? I posted a reply on a different topic and it ends up in here ? :blink: :blink: :blink:

Thanks for specifying that it may be XML parser related. Here....I'll just post the code.

<a href="http://www.tkqlhce.com/click-2005953-10362017?url=http%3A%2F%2Fshop.starwars.com%2Fcatalog%2Fproduct.xml%3Fproduct_sk u%3DSWGGDVCS%26rid%3DCJADPL00001&cjsku=SWGGDVCS" target="_top">
<img src="http://shop.starwars.com/image_file.xml?product_sku=SWGGDVCS&image_type=t" border="0" alt="Exclusive Chrome Plated Darth Vader Statue"/></a>
<img src="http://www.awltovhc.com/image-2005953-10362017" width="1" height="1" border="0"/>

Basically I have some code like this that produces the results...and others that are just slightly different that do not.

This code...same affiliate...does not produce the error.

<a href="http://www.jdoqocy.com/click-2005953-10362017?url=http%3A%2F%2Fshop.starwars.com%2Fcatalog%2Fproduct.xml%3Fproduct_sk u%3DSWHBEUP%26rid%3DCJADPL00001&cjsku=SWHBEUP" target="_top">
<img src="http://shop.starwars.com/image_file.xml?product_sku=SWHBEUP&image_type=t" border="0" alt="Kir Kanos & Mystery Figure Expanded Universe 2-pack"/></a>
<img src="http://www.ftjcfx.com/image-2005953-10362017" width="1" height="1" border="0"/>

theoracle...zen is after you...watch out you might end up with a bunch of agent smith's at your house.

Quote:

---

Originally Posted by deadeye

Thanks for specifying that it may be XML parser related. Here....I'll just post the code.

<a href="http://www.tkqlhce.com/click-2005953-10362017?url=http%3A%2F%2Fshop.starwars.com%2Fcatalog%2Fproduct.xml%3Fproduct_sk u%3DSWGGDVCS%26rid%3DCJADPL00001&cjsku=SWGGDVCS" target="_top">
<img src="http://shop.starwars.com/image_file.xml?product_sku=SWGGDVCS&image_type=t" border="0" alt="Exclusive Chrome Plated Darth Vader Statue"/></a>
<img src="http://www.awltovhc.com/image-2005953-10362017" width="1" height="1" border="0"/>

Basically I have some code like this that produces the results...and others that are just slightly different that do not.

This code...same affiliate...does not produce the error.

<a href="http://www.jdoqocy.com/click-2005953-10362017?url=http%3A%2F%2Fshop.starwars.com%2Fcatalog%2Fproduct.xml%3Fproduct_sk u%3DSWHBEUP%26rid%3DCJADPL00001&cjsku=SWHBEUP" target="_top">
<img src="http://shop.starwars.com/image_file.xml?product_sku=SWHBEUP&image_type=t" border="0" alt="Kir Kanos & Mystery Figure Expanded Universe 2-pack"/></a>
<img src="http://www.ftjcfx.com/image-2005953-10362017" width="1" height="1" border="0"/>

---

Another thing...it only happens when the banner is set to NOT SHOW DURING SSL SESSIONS. So, if I allow the banner during an SSL session...login will work. Any ZC creators know what could be causing this?

The problems with AOL and your cart are caused by AOL and not the cart. It's all down to the stupid way AOL (a.k.a. A O Hell) works.

When someone comes to a page on your site using AOL as their ISP then AOL caches each element of that page on different servers with different ip addresses. So let's say that the page is index.php, which calls in the header, footer, left and right columns, application top and bottom, languages, and multiple image files - they all get cached all over the place at different servers. I have seen AOL, even on a simple html page, recording 18 to 20 separate user sessions in the stats programme. Goodness knows how many user sessions they create for the Zen Cart pages.

The Recreate Session is usually the straw that breaks the camels' back as far as AOL is concerned - just one hurdle too many for it to deal with and it drops the session trail.

Vger

Quote:

---

Originally Posted by Vger

The problems with AOL and your cart are caused by AOL and not the cart. It's all down to the stupid way AOL (a.k.a. A O Hell) works.

When someone comes to a page on your site using AOL as their ISP then AOL caches each element of that page on different servers with different ip addresses. So let's say that the page is index.php, which calls in the header, footer, left and right columns, application top and bottom, languages, and multiple image files - they all get cached all over the place at different servers. I have seen AOL, even on a simple html page, recording 18 to 20 separate user sessions in the stats programme. Goodness knows how many user sessions they create for the Zen Cart pages.

The Recreate Session is usually the straw that breaks the camels' back as far as AOL is concerned - just one hurdle too many for it to deal with and it drops the session trail.

Vger

---

Crap...you are right. Those banners were causing me problems. Now I see AOL preventing logins with 'Recreate Session' set to True. This DID NOT happen in 1.2.5, but is occuring now that I'm using 1.3.0.2.

Ok. What I did to resolve the problem was revert to code from 1.2.5d (because I had it on-hand) for the function zen_session_recreate() in /includes/functions/session.php

Something in the changes for that function are not meshing well. My host is PHP version 5.1.4 (Zend 2.1.0).

I was trying to test changing things in that function, but could never get it to work in all scenarios. Could get it working if I had nothing in my cart when trying to login, but otherwise it's redirect me to the homepage with an empty cart. Then when I could login the item would be in my cart so that part worked. Very strange...maybe something about the 'session_id and session_regenerate_id' call aren't quite working right. Not sure.

Thanks sdwood!!!!!!!!!
I had the same problems. Changing recreate sessions to 'false' solved it.
discountperfumesuk.com

I am on version 1.3.7 and when my customer logged in it did not appear that they were logged in. I set the recreate session to false and this fixed the problem. Thanks again zen-cart forums :clap: