Prevent Spider Sessions

Hi,

I just come across that I have been leaving my "Prevent Spider Sessions" turned off until today. A lot of my pages have been indexed. I read the threads about the disadvantages. Now that I have turned it on, is there anything else I must do? Please let me know. Thanks.

Best regards,
Ethan

If your pages have already been indexed you will have to change the session id from ZENID to something else (perhaps SESID?) to prevent users from sharing sessions, and all the related problems.

You can find this in :
includes/init_includes/init_sessions.php and
includes/modules/payment/paypal/ipn_application_top.php

Hi Louis,

Thanks for your speedy response. Do you mean to replace ZENDID with SESID in the specified files? Sorry I am not very familiar with the session problems. May I also ask why is it important to prevent users from sharing sessions? What will happen if I don't do any changes? Thanks again.

Regards,
Ethan

Yes, you have to replace
Line #21 : zen_session_name('zenid'); with
Line #21 : zen_session_name('sesid');

That will force a new session id to be created when a user access your site.

Zen-Cart uses sessions to keep track of user activity, including user shopping carts. If you have two users accessing your site at the same time using the same session id ZENCART will see them as a single user. (Even though the IP-Address is different for each actual user).

IP's can not be used to track users as dial-up users normally get an IP assigned from a small share pool and can have a different IP everytime they click. (Depends on ISP setup)

IE. session id = user
All active realworld users share session id and add products to cart = chaos :no:

Hi Louis,

You mentioned that to fix my spider session problems, I have to replace:
Line #21 : zen_session_name('zenid'); with
Line #21 : zen_session_name('sesid');
in:
includes/init_includes/init_sessions.php and
includes/modules/payment/paypal/ipn_application_top.php

However, I couldn't locate the first file. Are you sure it is available for v1.2.7? Please advise. Thank you.

Best regards,
Ethan

Sorry I missed your post!:sleepy:

I am not that up to date with 1.2.7. I can only assume that since sessions are already used in this version the files would be there. You can also try using the "Developers Toolkit" under "Tools" in your shop admin. Go to the bottom and enter ZENID in the search block then select 'All files - Catalog/Admin' and click on the search button. This should list all files that contain the word ZENID. Should be one or two only.

Hope this helps.

Hi Louis,

Thanks for your reply. I did what you suggested and located the two files:
/includes/application_top.php
/includes/modules/payment/paypal/ipn_application_top.php

Please confirm if these are the right files. Thanks again :)

Best regards,
Ethan

OK, in your case you will have to change the ZENID in these two files to something else. All search engine indexed pages with ZENID as the identifier will then no longer create session problems for you.

Hi Ethan,

I happen to notice that you are using a SEF contrib. And I vaguely rembember to have seen some hardcoded zenid's in that mod. I might be wrong and/or it might be fixed in the current version (if not, it should be fixed asap), but if the zenid still appears after the formentioned changes, you know where it probably comes from...

edit:
Hmmm, it looks like you already made the change and it seems to work fine :-) (So I am probably wrong about the hardcoded zenid's )

Or maybe this is related: if I click on one of the currencies at your site the curreny switches, but if I click on another link after that, the currency magicly switches back to USD again.

Hi Louis,
If I shouldn't change 'zenid' to 'sesid', what should I change it to?

Hi paulm,
I am using the SEO contribution for v.1.2. I took Louis's advice to change 'zenid' to 'sesid' in:
/includes/application_top.php
/includes/modules/payment/paypal/ipn_application_top.php

Now that you mentioned the currency... I didn't know the currency problem is due to this spider session. When I click on a currency link e.g. EUR, the curreny switches from USD to EUR. But if I click on a second currency link e.g. AUD after that, the currency remains as EUR . It doesn't switch back to USD. Even after fixing the spider session issues, the currency problem persists. What should I do to fix this?

Thanks for your help, Louis and paulm :)

Best regards,
Ethan

I didn't know the currency problem is due to this spider session.Sorry for the confusion, but I did not mean to say that it was related, but it could be. I just clicked some links to see if I noticed any problems with the session id, and then I noticed the currency switch problem. And it I might be related to session problems, but I do not know for sure.

(And I would like to confirm that Louis is right about the fix, and that it does not matter what you rename it to, although I would not use any special characters. So "sesid" should be just fine.)

So "sesid" should be just fine.)

sesid is perfectly fine. Just so I understand, did you notice the currency problem before or did it start only after the changes?

Hi Louis,

Thanks for your reply. I had the currency problem before the changes. Not sure if it remains identical after the changes though. Basically, the currency still doesn't work when someone wants to change it a second time. Do you have any suggestions?

Regards,
Ethan

Could you create a new thread for this issue. Forum rules require only on-topic posts. I can try to assist you in the new thread.:thumbsup:

Going a little further, is there a way to completely make a site invisible to spiders and inaccessible to users without authentication? I'm thinking of a situation where any attempt at accessing any page on the site without such authentication would redirect the user (or spider) to a default "you are not authorized" page, where they could log in as a registered user.

I've seen such authentication work with asp pages, but I'm far from a php programmer.

Any possibility I could incorporate such functionality on my ZC site? I'm running 1.3.5.

Thanks in advance,
Gary :wacko:

You can set that up in the Configuration ... Customer Details ...

Make is so you must login to browse ... and that you must be approved to shop ...

That's super! Thanks so much. I'm embarassed I didn't see that in the Config area.

Gary

There is a lot in the Configuration to Zen Cart for all of the features and bells and whistles ... do not feel too bad about missing many of these ... :smile:

We encourage you to take the time each day to really read through each section and perhaps have a test site with the demo data loaded where you can test many of these features ... there is a lot to learn as so much is already built into Zen Cart ... :cool: