Shoppers' cart has another shopper's info

Multiple buyers complaining that when they checkout someone else's name and address info has been updated to their cart. We believe it's happening when multiple shoppers have active carts at the same time. Obviously, they are then abandoning the purchase.

We are running a big sale and attracting many more shoppers than usual.

One person mentioned that the last secure steps were very slow. Could this be an issue with the SSL provider? (Just guessing)

PLEASE help --- Thanks so much!

Correction: Other orders have no slow down thru the secures steps. We are entering orders online for people who call so we can see what's happening first hand.

I'm surprised not have had any help what so ever with this serious problem. Is there anyone who can help?

It would be most appreciated!

This type of issue occurs when sessions become intermixed - sometimes with other stores due to shared session storage filespace. If possible, use mysql based sessions instead.

If not, make sure the session storage path is not /tmp.

David

THANK YOU for the reply. Some of this is a greek for me. Is this something I should take up with my host provider, ior is it an issue with the template I'm using?

Thanks again!

Your host should be able to help you. The issue I mentioned requires adjustment to configure.php and perhaps the file path in admin -> Configuration -> Sessions

David

Could you please be more specific? I spoke with tech support for my host provider and they could find no settings on their end addressing this. Instead they suggested it had to do with my settings in gardencolordesign.com/admin > Configuration >Sessions

I've attached a screen shot of my current settings and would very much appreciate help on what specific changes to make.

Thanks so much!

After doing some reading at OS Commerce sites I a believe I should make the following changes:

Check SSL Session ID = TRUE
Regenerate Session ID = TRUE

I'd appreciate any opinions or confirmations of this.

Thanks

You may find those changes to be helpful. Test the cart after each change. Make sure you have addressed the session path issue as well.

David

Thanks for the reply. What should I change the session path to? Anything but /tmp?

Ideally, this should be something unique to your cart installation which is not visible to the web. In a pinch, the tmp folder inside your webroot will do - but that should be last resort. You'll have to consult with your host for the best results.

I generally prefer mysql driven sessions myself.

David

Well, I changes those two settings to TRUE and my host provider created a new sessions folder not called /tmp. Tested fine. Hopefully, this will stop the accidental mixing of sessions.

This should fix this known issue - basically, if you must use file based sessions, never share your session folder with others....

David