Checkout Problems

[theodin]

I'm having the problem described. My session data is

Session Directory /var/users/blahblah/htdocs/store/cache
Cookie Domain True
Force Cookie Use True
Check SSL Session ID True
Check User Agent False
Check IP Address False
Prevent Spider Sessions True
Recreate Session True
IP to Host Conversion Status false

Our server has https enabled, and it has a different hostname for the SSL secure server. Currently I cant get to the check out at all, the message:

"Whoops! Sorry, but you are not allowed to perform the action requested. You are still logged in to your account and may continue shopping. Please choose a destination from a menu."

Addittionally, it appears the state of being logged in or not seems to not be kept/remembered between page requests.

Any hints? Thanks!!

[Ajeh]

Turn off the:
Force Cookie Use True

Then if that is not enough, turn off:
Recreate Session True

[theodin]

I had to switch them both to get to step one of the checkout process. I'll continue to test and post anything more that is interesting. I also note the SSL sessions seem to sometimes timeout, but when they do, a message saying something about different ssl session id's is displayed. I wonder if this needs an edit...

I have also coded, tested and uploaded an update to v1.3 (curiously titled 'v1.4') of the LOGIN BOX sidebox contribution, which is at this moment under review... I hope someone finds it useful!

Thanks!!!!
theodin

[Ajeh]

The session times out after 24 minutes of inactivity ...

If the customer was logged in, they can login again and their shopping cart will be restored ...

[DrByte]

What version of PHP are you using?
Are you hosting on Windows or Linux?

[theodin]

Versions: (From Server/Version Page in admin)

PHP Version: 4.4.2 (Zend: 1.3.0)
Server OS: Linux 2.6.9-39.0.2.EL
Database: MySQL 4.0.25-standard-log
HTTP Server: Apache/1.3.36 (Unix) mod_gzip/1.3.19.1a FrontPage/5.0.2.2635 PHP/4.4.2 mod_ssl/2.8.27 OpenSSL/0.9.7a

Further info: alarmingly, the session seems to change its id quicker than the timeframe of 24 minutes. If I go to my checkout (which is SSL) then browse other items (using a sidebox, the bettercategories one) i go out of SSL mode to a normal http:// page. I can navigate for a bit, but usually i find that a couple of pages later, I cant go back to 'my account' without logging in again. (the invalid ssl session id message appears).

I made the changes suggested below by Ajeh, and I needed both to get past the previous problem. Using my modded login box contrib, i can see the logged in user session is not lost when it switches from https to http.

I'm really clicking things in any order, I really want to try and break this myself (as a user) with a chance to fix it before we go live!

Thanks again for your time!!

[theodin]

Another note: If i click the title of the "Shopping Cart [more]" sidebox, I'm taken to an UNSECURE version of the shopping cart. The unsecure vers. has the correct contents.

Dont know if this is a problem, or by design... I could change the module myself and post the update if necessary...