Session TimeOut during checkout

Hmm ive only just noticed that if you place something in your basket and login (https) . Then go to the shopping cart (http) the order dissappears and you are logged out? Hmm a whole host of problems it seems, i only hope there is an answer to the problem.

that has been the problem. the problem is the page prior to the checkout page cannot pass information over. so you lose the order info, along with your login info.

I just installed google checkout 1.4.6a to replace the original 1.4.5, thinking perhaps 1.4.5 is not compatible with zen cart 1.3.8. That did not solve the problem. What are your versions of zen cart and google checkout? I am not sure this has anything to do with google checkout though.

I also tried a different template that also did not help.

I've found that when you use different domains for the HTTP_SERVER vs HTTPS_SERVER, you need to use database-based session handling, not file-based ... see settings in your configure.php files.
I'm particularly fond of database-based SQL caching as well. But that may just be me.

Also, setting recreate-session to true is almost always an important safeguard to prevent session hijacking. Some hosts do stupid stuff and force you to have to make it false, but true is best if your host allows it. Trial and error will tell.

If you're brave, you could try changing the "Cookie Domain" setting to "false" ... but beware that it's almost always best to leave it at true.

All the rest of the sessions settings should be left at defaults.

I do use database-based session handling.
I cannot find recreate-session. do i need to add the line? whats the exact syntax?

one difference between my working site and non-working site was the non-working one was installed in the root folder. in other words, the admin folder is in public_html. can that be a problem?

w2e:

I do use database-based session handling.
I cannot find recreate-session. do i need to add the line? whats the exact syntax?The recreate-session session is found in the admin control panel under 'global/sessions'

my recreate-session was already set to true.

Interestingly, if i set SSL to true in admin/includes/configure.php, and click session under configuration in admin panel, i am asked to login every time! So I am not able to get to the session configuration at all with SSL turned on!

That's further proof that you've got a problem between your shared SSL domain name and your actual domain name ... meaning that the session cookie being set isn't remembering things properly, or your browser is blocking things, or your webserver is masquerading and not supplying the correct domain name, or somethings busted in the session functionality of your server. Or you've installed an addon or made customizations which have broken the built-in session handling logic.

Can you recommend a good hosting company other than hostgator?

Ive had excellent responses and support from my hosting terra networks (zen cart sponsors). Manage to work out the problem and they suggested the following:

Please check to make sure that you do not have "Force Cookie Use" set to
true, under Configuration --> Sessions in Zen admin.

You can only use that with full ssl or no ssl.

Everything is now working.

Thanks for the support on here too.

Lee

actually my force cookie use has been set to false.

i have decided to move to godaddy. mochahost sucks anyway. all their chat people know is "email support" and all their email support knows is buy this and buy that.

For those who are choosing web host: avoid mochahost!

w2e:

i have decided to move to godaddy. mochahost sucks anyway. all their chat people know is "email support" and all their email support knows is buy this and buy that.

Out of the frying pan and into the fire !! :eek:

Finally my site is up and running. Most importantly it can accept payments! The site is practically down for 10+ days with estimated sales loss at about $5K.

The lesson I learned is not php programming, but: choosing the right hosting company. I'd like to share the experience so you don't get held hostage by the hosting companies or lose money because of them.

I searched for the ratings of hosting companies before I made the decisions and still got burnt badly. I saw good words about godaddy on this forum and still end up getting held hostage. I guess the ratings and comments are more trustworthy if they are the results of comparison. Of course everybody's needs are different. If you are an expert and dont need much tech support, you probably want the server performance.

So far I have had experience with 6 hosting companies. I have tried zen cart with 4 of them. The only company I will recommend is Hostagor. People who would recommend the other 3 probably have not tried Hostgator. There is no comparison.

for similar cost of about $100/year, I rate them like this (9 the best, 0 the worst)
Server performance, load speed, etc:

godaddy: 1 (maybe if you spend more money you be faster. i dont know. I use the medium plan - the one in the middle.)
startlogic: 2
mochahost: 5
hostgator: 8 (maybe there are faster one, so i rate them 8)

tech support:
godaddy: 3
mochahost: 0 (they probably get paid $5 an hour)
startlogic: 5 (they are ok, except for the long wait for chat)
hostgator: 9

I left mochahost because I cannot get my problem solved and got no help from them. Now I get held hostage by godaddy. they want money from you anywhere possible. they dont even offer free shared SSL certificate as every other company does! they are unbearably slow. It takes like 1/2 hour just to bring up control panel file manager! Filezilla file transport constantly time outs. I cannot do anything without interruption. Compared to hostgator, they aint worth a penny. they also have this strange way of file management with this ugly looking long long file path, and they do not let your files sit outside the public_html folder. they dont use cpanel. things are organized strangely.

I am not getting paid by hostgator. I just have to get it off my chest. Now that I get held hostage. To get away, I will have to lose another 3 days of sales without guarantee that things will work immediately 3 days later.

the only good thing about godaddy is zen cart works.

I'm not sure where you saw good feedback about godaddy on the Zen Cart forums ... most of it is negative ... because their hosting is crap.

They're only good for domain names ... and even in that arena there are some other good services available.

Zen Cart has several recommended hosting services ... just click on the "hosting" link at the top of every Zen Cart support site page.
Glad you found a place where you're happy.

thanks for the tip. bluehost is much more superior to godaddy.

So the only solution was switching hosts?

I there nothing that can be done on the hosts end? I would love to give my host a tip. They are willing but seem to bounce me off saying there is not problem...

I do like my host and would rather have it fixed than to have to switch.

Ohh, yes I do have exact the same problem. Started a thread here
http://www.zen-cart.com/forum/showthread.php?t=98472
after I discovered this one...

A customer in Canada had a problem checking out, and wrote:

"I was a bit concerned that I had to enter my credit card number 3 times before it was accepted, It kept telling me that my time had expired, so I had to re-enter the number and code."

Can someone look at my session settings and see if they are ok. I am on a shared server, and my ssl and non-ssl addresses match (no shared certificate). I believe these setting were made a few years ago when I did have shared ssl. I have not had any US customer tell me of any problems. I tested the site and could not detect anything wrong.

Also, I have user tracking enabaled, and went online, and another Canadian customer seemed to have abandoned the sale when they received the same session timeout error on the checkout page. Here are my settings:

Cookie Domain True
Force Cookie Use False
Check SSL Session ID False
Check User Agent False
Check IP Address False
Prevent Spider Sessions True
Recreate Session False
IP to Host Conversion Status true

Thanks.

Sadie
https://www.vintageknits.net/store

I haven't figured it out yet, but the change on my server was an upgrade from php4 to php5. If I downgrade to php4, everything works fine. The session settings in php.ini look to be the same, and changing any of the settings in zencart->configuration->sessions don't make a difference. Admin-side sessions work fine in either case. Domain of cookie looks right in the firefox webdeveloper toolbar. Cookie-id stays the same when switching to ssl. Sessions are in files in a local writable directory, and the contents of the file changes on each click, which I assume is appropriate.

Any ideas?

I fixed it by changing the HTTP_SERVER to the same URL (https://www.piexx.com) as my HTTPS_SERVER in both the front and the backend include files, and run the whole thing over SSL. I'll have to see if the server load is too high doing that, but at least it works.

jondaley:

I fixed it by changing the HTTP_SERVER to the same URL (https://www.piexx.com) as my HTTPS_SERVER in both the front and the backend include files, and run the whole thing over SSL. I'll have to see if the server load is too high doing that, but at least it works.

Hi, I'm having the same problem with customers being shown a time out page when they submit payment.

Jondaley - can you tell me how you made your changes? How do I tell it to run over SSL and where do I change the HTTP-SERVER? Thanks!

The info is in the config.php files.
They can be found in the following folders:

/public_html/admin/includes/

/public_html/includes/

Make sure you understand what you are doing with them. Consult your Host or read up in the forum.