Message when cookies are disabled?

Hallo,

When a browser does not accept cookies, I have a problem ...

Firefox issues the following message:

The page isn't redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

• This problem can sometimes be caused by disabling or refusing to accept cookies.

Internet explorer ( :censored: ) is indefinitely trying to do what it was asked, probably loading the server with unnecessary traffic. (Zen cart sends a cookie, explorer blocks it, zen cart sends another one, explorer blocks it ... for ever)

Is it possible to have zen cart check if cookies are disabled, and -if so- cease any activity and inform the user that he must enable cookies?

Kind regards,
orange_juice

Sounds like you've got an addon installed or server configuration problem that's breaking normal operation.

Indeed ...

Thank you for your prompt reply.

My cart's behavior is rather different that the original zen-cart in this issue.

I will try to find out where the problem lies.

However, I would very much like to prevent people from navigating in the site unless cookies are enabled.

Would this be possible?

Kind regards,
orange_juice

Your time will be better sent figuring out what's causing the unnecessary redirects.

orange_juice:

inform the user that he must enable cookies?

Sorry, I don't know the technical answer to your question (though Googling force cookie use might provide some answers), but if I have cookies disabled, I've done so for a reason, and I'd leave your site before I'd let you dictate how I operate my browser. Just my $.02 worth.

DrByte:

Your time will be better sent figuring out what's causing the unnecessary redirects.

Thanx, this is the proper thing to do.

The issue should be lying at my host's configuration, because he uses lighttpd. Along with Simple SEO url those redirects initiate.

I am currently talking through this issue with them.

stevesh:

Sorry, I don't know the technical answer to your question (though Googling force cookie use might provide some answers), but if I have cookies disabled, I've done so for a reason, and I'd leave your site before I'd let you dictate how I operate my browser. Just my $.02 worth.

Opinion respected. I apologize for the wording. At my second post, I made it better:

However, I would very much like to prevent people from navigating in the site unless cookies are enabled.

Nevertheless, I will try to cater for all users. This is the best, I agree. :hug:

Kind regards,
orange_juice

The issue of the redirects is solved now.

It was caused by the default value of php for session.use_only_cookies which has changed from 0 to 1 at version 5.3.

Kind regards,
orange_juice

It is a security measure, and therefore the "Force cookies" option might be considered as a necessity?

http://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies

Sorry for the new post, I did not catch the 7 minutes limit!

Kind regards,
orange_juice

My server has session.use_only_cookies set to 1 and it works fine for me. I can browse the store, login, add items to my cart, complete checkout.

DrByte:

My server has session.use_only_cookies set to 1 and it works fine for me. I can browse the store, login, add items to my cart, complete checkout.

How is this possible? Is there a special setting I have to make at the admin menu or the server?

I have just installed a fresh zen-cart 1.3.9g with a demo store and I am trying to navigate with mozilla-firefox-3.6.9 in a linux gentoo environment.

As expected, I get a ?zenid= ... at the end of my url.
However, this number changes constantly after each click I make.

Therefore, when I send something to the shopping cart, although I have a zenid number, I get a message "your shopping cart is empty" because the shopping cart's zenid is different than the one I had at the product's page.

Combining this constant ?zenid number change, with the simple SEO url, we get infinite redirects.

However, when I disable the session.use_only_cookies by setting it to 0, everything works like a charm.

:dontgetit

Kind regards,
orange_juice

Apparently your server is configured in such a way as to not properly set up sessions, thus pushing an invalid value into the session cookie, which then doesn't match what the server is expecting, which then forces it to put the zenid into the URL, which then your URL rewriting rules are turning into redirects.

When cookies are enabled:

Everything works fine.

When cookies are disabled and session.use_only_cookies=0:

Everything works fine.

When cookies are disabled and session.use_only_cookies=1:

The ?zenid number changes in the url after each click.
This happens at my home server, at my host's lighttpd server and at my host's apache - 2 server.

session.use_only_cookies=1 by default at php 5.3

session.use_only_cookies specifies whether the module will only use cookies to store the session id on the client side. Enabling this setting prevents attacks involved passing session ids in URLs. This setting was added in PHP 4.3.0. Defaults to 1 (enabled) since PHP 5.3.0.

Kind regards,
orange_juice

orange_juice:

When cookies are enabled:

Everything works fine.As expected.
orange_juice:

When cookies are disabled and session.use_only_cookies=0:

Everything works fine.As expected.> orange_juice:

When cookies are disabled and session.use_only_cookies=1:

The ?zenid number changes in the url after each click.As expected.

Thank you!

This trend seems to imply that it is more secure for both the server and the client to accept the session cookie of zen-cart and set the browser to automatically delete it after the browser is closed, than to reject cookies and allow the session to be appended at the url.

Therefore, I think the Configuration -> Sessions -> "Force Cookie" = true setting, is closer to what Google - Yahoo and other major websites with robust privacy policies accept as a sound and effective security measure.

Kind regards,
orange_juice

Hallo again!

I saw that when I set Force Cookie = true, a cookie named "cookie_test" is sent from my store which expires after one month.

Would it cause any technical issue if I set this cookie to expire at the end of the session?

Thank you for your help.

Kind regards,
orange_juice

It won't cause any technical issue. What specific reason do you have for wanting to change it?

Thank you for your prompt answer.

My thought is the following:

I have set Force cookies = true and when someone with disabled cookies tries to log in or place something in his basket a message appears that notifies him of this policy.

Since I "oblige" users to accept cookies, I would like to inform them of which cookies are stored into their computer from my site.

There are two: cookie_test and zenid.

zenid expires at the end of the session. I consider very nice and discreet to have cookie_test to expire at the end of the session too.

This way, even the most sensitive user about cookies will feel that "I entered that store, they informed me that they make the most to keep my visit safe without collecting any personal data in cookies, and when I exited it was like I never entered because nothing was left in my hard disk."

Kind regards,
orange_juice