Prevent Spider Sessions

[dealbyethan.com]

Hi,

I just come across that I have been leaving my "Prevent Spider Sessions" turned off until today. A lot of my pages have been indexed. I read the threads about the disadvantages. Now that I have turned it on, is there anything else I must do? Please let me know. Thanks.

Best regards,
Ethan

[Louis]

If your pages have already been indexed you will have to change the session id from ZENID to something else (perhaps SESID?) to prevent users from sharing sessions, and all the related problems.

You can find this in :
includes/init_includes/init_sessions.php and
includes/modules/payment/paypal/ipn_application_top.php

[dealbyethan.com]

Hi Louis,

Thanks for your speedy response. Do you mean to replace ZENDID with SESID in the specified files? Sorry I am not very familiar with the session problems. May I also ask why is it important to prevent users from sharing sessions? What will happen if I don't do any changes? Thanks again.

Regards,
Ethan

[Louis]

Yes, you have to replace
Line #21 : zen_session_name('zenid'); with
Line #21 : zen_session_name('sesid');

That will force a new session id to be created when a user access your site.

Zen-Cart uses sessions to keep track of user activity, including user shopping carts. If you have two users accessing your site at the same time using the same session id ZENCART will see them as a single user. (Even though the IP-Address is different for each actual user).

IP's can not be used to track users as dial-up users normally get an IP assigned from a small share pool and can have a different IP everytime they click. (Depends on ISP setup)

IE. session id = user
All active realworld users share session id and add products to cart = chaos

[dealbyethan.com]

Hi Louis,

You mentioned that to fix my spider session problems, I have to replace:
Line #21 : zen_session_name('zenid'); with
Line #21 : zen_session_name('sesid');
in:
includes/init_includes/init_sessions.php and
includes/modules/payment/paypal/ipn_application_top.php

However, I couldn't locate the first file. Are you sure it is available for v1.2.7? Please advise. Thank you.

Best regards,
Ethan

[Louis]

Sorry I missed your post!

I am not that up to date with 1.2.7. I can only assume that since sessions are already used in this version the files would be there. You can also try using the "Developers Toolkit" under "Tools" in your shop admin. Go to the bottom and enter ZENID in the search block then select 'All files - Catalog/Admin' and click on the search button. This should list all files that contain the word ZENID. Should be one or two only.

Hope this helps.

[dealbyethan.com]

Hi Louis,

Thanks for your reply. I did what you suggested and located the two files:
/includes/application_top.php
/includes/modules/payment/paypal/ipn_application_top.php

Please confirm if these are the right files. Thanks again :)


Best regards,
Ethan

[Louis]

OK, in your case you will have to change the ZENID in these two files to something else. All search engine indexed pages with ZENID as the identifier will then no longer create session problems for you.

[paulm]

Hi Ethan,

I happen to notice that you are using a SEF contrib. And I vaguely rembember to have seen some hardcoded zenid's in that mod. I might be wrong and/or it might be fixed in the current version (if not, it should be fixed asap), but if the zenid still appears after the formentioned changes, you know where it probably comes from...


edit:
Hmmm, it looks like you already made the change and it seems to work fine :-) (So I am probably wrong about the hardcoded zenid's )

[paulm]

Or maybe this is related: if I click on one of the currencies at your site the curreny switches, but if I click on another link after that, the currency magicly switches back to USD again.