Session Clearing Cart on Browser Close. Please Help!

[briandoakes]

Our ZenCart site had been running on the default 24 minute Session interval at which time non logged user’s carts would be cleared as defined in includes/functions/sessions.php

Yesterday I was able to change that to 24 hours on our DEV test site and it worked all day long without issue.

In the sessions.php file, this was the original 24 minute code:

if (STORE_SESSIONS == 'db') {
    if (defined('DIR_WS_ADMIN')) {
      if (!$SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900)) {
        $SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900);
      }
    } else {
      if (!$SESS_LIFE = get_cfg_var('session.gc_maxlifetime')) {
        $SESS_LIFE = 1440;
      }
    } 

I changed it to the following to last for 24 hours:

 if (STORE_SESSIONS == 'db') {
    if (defined ('DIR_WS_ADMIN')) {
      if (!$SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900)) {
        $SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900);
      }
    } else {                                                                                                                   
        $SESS_LIFE = 86400;                                              
    } 

I tested in IE, Firefox, Mozilla and Chrome where I would close the browser and come back an hour, 2 hours, 3 hours later and the shopping cart would be full.

Today, both of our sites Live and Dev are automatically clearing a user’s cart (non logged in) when the browser is closed and re-opened.

I restored the original file that was edited, no luck. I also checked a 3rd ZenCart Site that I set up for 1.50 that hasn’t been touched in 2 months and that’s doing the same thing, so at this point I do not think the issue is the result of the file change.

I also found the following on Zen Cart's site:
http://www.zen-cart.com/content.php?317-cookies

"In a traditional configuration, and by definition, this session cookie expires at the end of the visitor's session in the browser, or at a predefined time (typically 24 minutes) after their last "click", whichever is sooner."

This would lead me to believe that a person's cart would be emptied upon browser close, however all day yesterday and prior to yesterday a cart would remain full for at least 24 minutes.

Can someone please help?

Our live site is
http://www.maxximastyle.com

[wilt]

Hi,

here is the expected behaviour

As a guest if you close the browser (that includes closing all browser tabs and other instances (windows) of that browser), then the session will expire and any cart details will be lost.

If you are a logged in user, with items in the cart and you close the browser, then on restarting the browser and logging in as the previous user then cart items will be restored, as these are stored in the Zen Cart database.

The code you changed above, should have no affect on this, as whether the session persists across browser close/opens is affected only by how the cookie is defined.

If you are saying that a guests cart items are persisting across a browser close/open then either you have code changes somewhere
else that affect that cookie definition, or there is a bug in your browser.

For reference. The cookie is defined in includes/init_includes/init_sessions.php

if (PHP_VERSION >= '5.2.0') {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), $secureFlag, TRUE);
} else {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), $secureFlag);
} 

the important part of that being the initial 0 parameter which sets the cookie lifetime.

Note it is also possible that when closing/reopening the browser, to propagate the session if PHP cannot create a cookie, and by using a URL that contains the zenId of the previous session, as altough PHP's garbage collection should stop this, it's not always as consistent as it should be.

[briandoakes]

Thank you so much for your help.

We were affected by Hurricane Sandy so my mind was a little cloudy the past few days :-)

So if I understand you correctly, the code you reference above in includes/init_includes/init_sessions.php, if I change that to what you listed, it will save the cookie regardless of whether a user closes their browser?

Thanks again!

---------------
EDIT:
I just tried editing that code you had as this is what ours says:

if (PHP_VERSION >= '5.2.0') {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), FALSE, TRUE);
} else {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''));
} 

It did not work, I have to check what version PHP we are running.

[briandoakes]

just checked, we are running PHP 5.3.3, I tried changing your code to:

if (PHP_VERSION >= '5.3.3') {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), FALSE, TRUE);
} else {
  session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''));
} 

that did not work either. any help would be appreciated. thank you.

[wilt]

I'm not sure why you think changing the php version would have any affect on the cookie lifetime.

The php version check is only used to determine whether we set the secure/http_only flags, not the cookie lifetime.

As I said earlier it is the initial 0 entry in the parameters for session_set_cookie_params that determines the life of the cookie

e.g. we do
session_set_cookie_params(0

so the cookie has a lifetime of 0 seconds between browser restarts.

you can set this to a value that represents the number of seconds that the cookie will last between browser restarts.

Could you explain a bit more about what you are trying to achieve ?

[briandoakes]

I thought it, because i am not a developer so I do not understand PHP too well. I am a designer. I can work within PHP and do some basic stuff changing variables, but i fully admit I don't understand it 100%.

I too the exact code you had and changes the 0 to 3600 and it still did not work.

What i am trying to achieve is when a user closes their web browser and comes back within a set period of time (3600 seconds / 1 hour), there cart will still be there. Just looking to improve our cart abandonment rate.

thanks again for your help!

EDIT:
This is what i tried last and it did not work.

if (PHP_VERSION >= '5.2.0') {
  session_set_cookie_params(3600, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), $secureFlag, TRUE);
} else {
  session_set_cookie_params(3600, $path, (zen_not_null($cookieDomain) ? $domainPrefix . $cookieDomain : ''), $secureFlag);
} 

[briandoakes]

Hey!
Ok, it looks like what you posted IS in fact working on our TEST site.

It looks like when our test site was backed up from our live site, the LIVE DB was dumped into the TEST DB, so the cache folder path in the Admin Setting was wrong... All is working now.. let me see how it works for the next hour... but THANK YOU so much!

[wilt]

Hi,

I'm glad you seem to be making some progress. However I should offer some further advice as to why Zen Cart works the way it does and why you should be careful in changing that.

Losing session on a browser close is a Privacy issue.

It protects the users privacy in a number of circumstances.

That may be when the user is using the browser from a shared location. e.g. a computer in a local library, or even a computer shared between family members.

In those cases, there would be an expectation, that just opening a browser would not allow sharing of information. e.g. I don't want my wife to see what I am buying her for our anniverary.

In these circumstances, if you change the default behavior, you must make sure you offer enough information to the user, to allow them to realise the affects on their privacy of the changes you have made.

[briandoakes]

Thank you, totally understand what you are saying and I 100% agree with you.

I know very reputable sites like ############ keeps items in a cart for a set number of time after close before clearing it.

Since we have not collected any user data at that point of the process, I am not as concerned with name / email address being displayed on a publicly accessible computer.

And in the "I don't my wife to see what im buying for her", unless your wife is going to get super excited over knowing you're buying her a light bulb, LOL the benefit outweighs the risk.

I am going to look into this a little bit more before pushing any changes live, maybe some verbiage in the cart that says their cart will be cleared after X amount of time would be the best way to do it. Unless you can think of another alternative? I do not want to do a Browser Close Pop Up, that just gets annoying to everyone.

Thanks again!

[DrByte]

There's an addon called "CookieCart" which might be of interest to your unique needs.