Urgent help needed... customer login / session problems

Hi,

Our customers have been complaining that they cannot log in, or check out. Evidently this does not happen to all customers, because we still receive some successful orders. However, for the past month there has been an increasing number of complaints, and it's turning into a very urgent problem.

Symptoms:

• When customers try to log in, they either get thrown to the homepage as Guests, or back to the login screen.
• With my own account as customer, I was able to make 1 successful checkout, and then my account started having the same problem.
• I've created a new customer account to test this problem, and the new one is having the same issue.
• Apparently, if the customer's account already has a non-empty cart, the contents get added to the "guest cart" after the unsuccessful login attempt. At least that's what seems to be happening.
• Account creation is working. Admin login is working. No configuration changes have been made by us or our hosts as far as I know.
  What I've tried so far:
  I've spent a few hours searching the forums for this problem... many similar issues but nothing identical, at least the solutions I've found are not working.
• I've tried changing "Recreate Sessions" to False... does not help
• I've tried disabling SSL, just to troubleshoot... doesn't help either
• Tried searching for any php errors or warnings... none appear on screen, and DrByte's error-logging add-on also shows no errors
  Server info:
• Server OS = Windows
• ZC version = 1.3.0.1 (some add-ons and even our own custom modifications...)
• PHP version = 4.4.1 (Zend: 1.3.0), though we're scheduled for an upgrade to 4.4.9 tomorrow
• MySQL server version = 4.1.20-log
  Settings in Admin -> Configuration -> Sessions:
• Cookie Domain: True
• Force Cookie Use: False
• Check SSL Session ID: False
• Check User Agent: False
• Check IP Address: False
• Prevent Spider Sessions: True
• Recreate Session: True (though I've tried False too, as mentioned)
• IP to Host Conversion Status: false

Our URL is : w1w1w1.1a1c1h1a1d1i1r1e1c1t1.1c1o1m (Sorry for the paranoia... just delete the "1"s)

I would HIGHLY appreciate any help or troubleshooting tips... the sooner the better because I am running out of options... (and sanity)

Thanks!!

When did this start to happen? Have you installed any module recently/around that time?

I don't know exactly when this started to happen.... we've started receiving a small trickle of complaints some 1 or 2 months ago, but I wasn't able to reproduce it then (I didn't even get a useful description from the customers of what really happens to them). And like I said, we are still receiving orders from other customers - who can log in and check out normally, and report no problems.

The only add-on I've installed recently is Improved Attributes Controller, which only changes the admin section.... I've also made small changes of my own, but nothing that touches sessions or anything like that (well, as far as I know).

Is there a way to somehow track down the piece of code where the login fails? What would be the best method to go about pinning down the problem....

It would be helpful to reproduce the problem if possible to see if it is:

1. browser specific? (does the same thing happen on all browsers?)
2. product specific? (maybe for some strange reason it happens only if the customer has some specific item in cart? Items with attributes for example)
3. procedure specific? (certain steps may need to be taken for the error to happen?)
4. do you have a test account where we can get to see this problem? Can you post it?

It doesn't seem to be browser-specific (tested with both IE and FF, with cache/cookies/etc cleared), or product-specific. Still checking about the exact procedure that makes this happen... I've tried creating yet another account but this time I am unable to reproduce it! Strange.

I will PM you shortly with details of the test account(s) involved.

PM sent

After some testing it seems that most log-outs happen when items are added to the shopping cart.

It sends you to the shopping cart screen as normal - but the link at the top changes to "log in", and the cart effectively becomes a "visitor cart".

Basically, this is an urgent plea for help, to anyone who knows anything...
How would you troubleshoot something like that?

Is there a way to track down the problem? What exactly happens, internally, when an item gets added to the cart? Which files are called... etc...

My sessions are stored in the database... Is there a way to figure out why a specific session gets logged out?
Perhaps by looking at it in the database's 'sessions' table? I tried, but it all looks greek to me, I just don't know what I'm looking at.

Any help would be very, very, very appreciated.

Try to switch to the classic template and see if the error still happens.

Install a clone of the site somewhere else, see if it still has the error. What if you remove the modules installed on that clone site, one by one, see if it works.

Yes, I've just transferred a complete copy of the ZC folder from the web to a dev server on my own computer. At least I've established that the logouts still happen, so it's not our host at fault.

So I'm going to have to test it by undoing each change, one by one. Unfortunately several changes were made to the classic template itself without overrides... I'm just hoping the database itself hasn't accumulated some errors that could be causing this.

If you have any other tips that could help me see what exactly happens to the session and why - perhaps by looking at server logs or deciphering the session entry in the database, somehow - it would greatly help.

Thanks

Okay.... I've managed to alleviate the problem, but I still do not understand the cause.

I established that none of the add-ons are at fault, and that it was probably the database (I told a fresh install on another server to use a copy of the database from the existing, problematic install - and the log-outs were still happening)

So, in the configure.php files, I changed:
define('STORE_SESSIONS', 'db');
to define('STORE_SESSIONS', '');

And now the log-outs do not seem to happen anymore.

But... what does this tell me? Is there any reason that sessions stored in the db might break, but not when they're stored in files?
I'm just trying to understand the problem, and make sure that it doesn't happen again.

Is it recommended to continue working with this setting? (we have quite a large store, in case this affects performance)

Thanks

Try to do a repair (using phpmyadmin) the session table.