Problems since host upgraded PHP to suPHP

Do these symptoms only occur on your admin side? ie: is the storefront okay?

Why are you using subdomains?
Why are you using shared-ssl?

DrByte,

Storefront is not OK. If shared SSL is enabled in checkout, then sessions expire at the point of clicking on the "go to checkout button". I get the "oops your session has expired" message each time I try to checkout under shared SSL.

a) Sorry, I meant add on domains not subdomains. Forgive me, my brain is getting a bit fried over this. The reason I use add on domains is that I currently host five domains on one hosting account. Using add on domains on one hosting account is cheaper than five hosting accounts.

b) Why shared SSL? Same reason. Five dedicated certs would be expensive. Shared SSL is free. Why am I so cost concious? Becuase my sites are not generating revenue at the moment so I need to limit my outgoings until I can get some money coming in.

as I mentioned in my previous host of today, the session expiry seems to happen at the point of moving between http and https server. It seems to happen both ways: https to http (in admin) and http to https (in store, at checkout).

Currently sessions are stored in the database. Would storing session in a folder make any difference?

Really would like to get to the bottom of this if possible - it's bugging me big style.

Dr Byte.

My new host seems to have solved the problem by creating a php.ini file and putting in the statement:

suhosin.session.encrypt=off

From what I understand, the suhosin php "hardening" patch by default has suhosin.session.encrypt=on. I understand this encrypts the session ID's that Zen Cart generates. It lools like there may be a problem passing session ID's between http and https servers when encrypted. I'm guessing.

Do you have any comment about setting suhosin.session.encrypt=off? Any issues for Zen Cart?

Not sure if I'm allowed to but may I credit Birch Hosting for working this out ( https://www.birchhosting.com ). A first class web host with excellent tech support - and they offer Zen Cart as a one click install. Very competively priced too.

Rat

Ok Here is the thing, this may work specifically for your situation on your specific host.

Zen Cart users do not need to disable suhosin.session.encrypt to off because Zen Cart works just fine with it set to ON. It is not a Zen Cart issue.

Suhosin and Zen Cart are compatible. Suhosin and Shared SSL are compatible.

The situation you have will have more to do with how your host has things setup as there must be something out of the ordinary running or a misconfiguration on the server. As suggested in a previous post I tested this and could not replicate this issue on our server testing environments. This in short means that it is localized to your hosting company.

Reason why I have posted this is because stuff like this travels like wildfire and gets misinterpreted as gospel.

Qdixon,

Sure, I understand that this is not a "one size fits all" solution. And if Zen Cart usually works fine with suhosin.session.encrypt=on then the suhosin.session.encrypt=off solution is just masking the problem not identifying the root cause.

What I can't figure out is that the SAME problem occured on TWO webhosts. Can both of them have messed up their server configurations resulting in the same error?

In the meantime I'm happy that my sites are working without having to fork out for a bunch of dedicated SSL certs.

Ratty M

RatMonkey:

Not sure if I'm allowed to but may I credit Birch Hosting for working this out. A first class web host with excellent tech support - and they offer Zen Cart as a one click install. Very competively priced too.

Rat

Hmmm... just about every "popular and cheap" host offers "one-click install" which is actually the WORST POSSIBLE WAY TO INSTALL COMPLEX SOFTWARE, and if they are advocating that you install programs using these "one-click" systems then they are actually doing you a disservice.

Schoolboy,

I must say I've never used a one click install. To me offering a one-click indicates that the host supports Zen Cart (or is supposed to). As I was moving host I followed the Zen Cart recommended procedure for moving to a different server to make sure the templates and mySQL databases (including an installed patch on one site) migrated properly - and the transfer worked fine.

Regardless of offering one click installs, Birch Hosting is a good host compared to my previous host: I now have twice the space and bandwidth, technical support that works, unlimited add-on domains, sub domains and mySQL databases and I'm paying 20% less than with my previous host! I can't argue with that.

It's not about what they "offer". This gives you no indication of their competence.

QDixon and DrByte are the LEAD DEVELOPERS for zencart, so they know what they are talking about. If they are telling you that the problem lies with your host, then you should believe that to be 100% true.

Practically every webhost offers a range of "products" these days - most are subscriptions to 3rd-party providers, and this is also true of WHM and C-PANEL.

The fact that they offer these "tools" and "services" is no indicator of being a good host.

Your host appears to be incompetent.

We have installed over 300 Zencart programs since 2004, and because we did a LOT of research first on who (in the hosting industry) knows what they are doing, we have NEVER EVER had a problem with an installation.

Your host is clearly incompetent. Sorry to be so frank, but they are.

schoolboy:

Your host appears to be incompetent.

We have installed over 300 Zencart programs since 2004, and because we did a LOT of research first on who (in the hosting industry) knows what they are doing, we have NEVER EVER had a problem with an installation.

Your host is clearly incompetent. Sorry to be so frank, but they are.
schoolboy is indeed making some very strong and broad statements. I don't have enough actual information about your host to be able to make the same statements; however, I am indeed of the opinion that your host needs to take an active role in sorting out the problems you're encountering. If they're worth their salt then they'll see that their time investment in fixing this will actually benefit all of their customers, not just you. Hopefully they can see that bigger picture. If not, I question whether your "20% savings" is actually savings at all.

Schoolboy,

Now you've got me interested; I'd like to benefit from your research if I may. Can you please recommend a host who is running suPHP, Apache suExec and the Suhosin patch. I'd like to sign up with them and see if the problem replicates.

Schoolboy,

I think people who read your negative comments about my new web host need to understand your comments in some context. The webite of the company in your Zen Cart profile, presumably the company you work for, has an affiliation to another UK web host that your company "strongly recommends". Interestingly the web host that your company stronly recommends offers Zen Cart as a one click install, despite your comments about this being the "worst possible way to install complex sodtware".

I think people who read your post about my UK host being "clearly incompetent" should understand your affiliation to another UK host that is a competitor of my host.

I'm just trying to get some balance here as your negative comments were, in my veiw, unnecessary strong.

Ok ok, thats enough.

I think this is a bit my fault. I was only trying to point out the facts so that things were plain and simple for other people coming to read this thread from other sources. You must understand people repost this stuff and blog about these things all the time giving misinformation on the net. I wanted to make sure it was accurate.

As for me being a "Lead Developer", that I am not. That honor belongs only to Ian, Chris, Linda and Kim. I have been here since day one and am on the support team with a few others but that is my current role.

It is important to point out that there are literally hundreds of ways to setup servers to work and literally thousands of combinations of things that can go wrong. It has nothing to do with being incompetent. It has more to do with the interest of streamlining the way the server works to be compatible with the way Zen Cart runs. Most hosts don't do this because their customer base does not dictate that.

Ratmonkey, you simply got tangled up in a configuration that wasn't streamlined for what you needed and your host was trying their best under the circumstances to make things work with the current configuration they had. It ended up producing the weird issue you were having with shared ssl.

Firstly, I am sorry if YOU were offended by my comments about your host. My remarks are aimed at them. I take Qdixon's point that there are literally thousands of ways servers can be set up, and different hosts have their "reasons" for certain configurations.

However... your first post on these "problems" appeared in 18 March.

It is now 4th May.

All that time, you have not had a functioning webshop.

So you have had nearly 9 weeks of "down-time".

That means you are 9 weeks "behind schedule". While there is no "tangible standard" for the time a site goes live, to the time it starts taking orders, it may interest you to know that on one occasion a couple of years ago, we STARTED work on a new ZC site at 9am in the morning, and by 3.30pm that afternoon it was getting sales. (It was an urgent job that needed a shop to take advantage of a breaking ad campaign in regional newspapers).

Our current webhost is the result of several tearful experiences (like you are now having), and in this regard we are ruthless. After a while (some 4 years ago now) the instant a host demonstrated the slightest degree of "improper" hosting (for zencart), we moved on.

Time is money in eCommerce. An "inadequate host" is probably the costliest impediment to an eCommerce site.

Since hosting with our current host (and we have a LARGE number of clients on their servers) we have never ever had a single second of down-time. And we've been with them for a while now.

We do 3 to 4 zencart installation every month, and do these manually (even though Softaculous is available), and our "record" for a custom install (with a custom template) is just under 15 minutes. (ie: from zero to working custom website in under 15 minutes.)

9 weeks later, and you're still demonstrating a blind loyalty to a host that is holding you back. That's something I really find difficult to understand.

I am not writing this to "boast" of our "prowess" (we have a lot of experience in ZC, and have been involved in websites since 1993). I am hopefully illustrating to you that if your objective is to start an online business, and make money... you're allowing a supplier to completely dictate whether that happens - or not.

Just change your supplier, that's all...

DrByte, Qdixon,

I have just found that I can solve the session expiry problem with a blank php.ini file. In other words I do not need to turn suhosin session encryption off, I just need a completely empty php.ini file to exist. I have tried this with a fresh Zen Cart install to be sure, and it works.

Freaky stuff. I have no idea what's going on here.