what is recreate session

What does the option recreate session do. My customer login in doesn't work when it is enabled but it is enabled as default. I would imagine it was intended to be used. Does anyone know if it is a security issue if disabled when using ssl?

Thanks

TFMegatron

Yes, it is related to security, Specifically it is meant to limit problems caused by session hijacking.

Normally when you first visit a zen cart shop a zenid is assigned to you. Sometimes you will see this in your browser url depending on your cookie settings. In the past when you then logged in, you would keep the same zenid.

This would cause problems if for some reason a url to the site got 'leaked' to the public. Some one else could then 'hijack' your logged in session.

Session recreate basically generated a brand new zenid, while still remembering your current session (e.g. any items you had in the cart as a guest).

A numberof people have posted problems with using session recreate, although as yet I have not found a common denominator, although fedora/window servers do tend to crop up a lot.

The problem is being worked on :)

I appreciate the response and info.

Would this be linked to the problem that I have where if a person fills the shopping cart and then leaves the site for some time. When he returns the cart is still full. I imagine this is related?

Thanks
TFMegatron

I doubt it is related, unless the person returns to the site using a bookmark or other link which contains a zenid.

Otherwise, what happens when a person returns to the site depends upn their login status.

For example, If I visit a ZC shop as a guest(e.g. not logged in) and put something in the cart. If I then close the browser, and return some time later, then there should beno way that the shop remembers me and I shoudl not return to a cart with anything in it.

If however I log in and put something in my cart, then close the browser. Then return sometime later, there is a good chance that the cart will still contain my previous details. Whether it does depends on a number of factors.

The cookie time for a logged in user is set at arround 24 minutes, so strictly speaking if a person returns after that 24 minutes then their session should have expired, and none of their details would be remembered.

However their is a caveat to that. The garbage collection that clears session cookies can only run if their is a visitor to your site. In other words, it is possible that if no one visits your site for 1 hour or whatever, that original customer can return and still have their original session available.

A numberof people have posted problems with using session recreate, although as yet I have not found a common denominator

AOL users. If you set Session Recreate to true then AOL users will never be able to keep a session trail on your website. That's down to the proxy caching system that AOL uses and not the fault of Zen Cart.

Vger

Thank you again for the info.

TFMegatron