This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this.

I was testing some features on my dev server while someone else was logged in on the frontend as well. At one point after refreshing I saw that I was suddenly logged in as the other user's account, I did not even know which email they were using and had never logged in with that account before but I could now do everything from change his password to place orders with his account.

As far as I know I'm not doing anything weird with sessions, but the most likely place I could see this going wrong is a Helper class that is used in various places but that is only used for getting the current user's customer group ID.

It is a fairly standard and clean Magento 2.1.9 installation on a LAMP stack, we started developing two weeks ago so we have one custom module that we are working on right now and no third party modules.

  • It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account. Sep 29, 2017 at 6:17
  • I tried and I was able to actually place the orders and change their account information Sep 29, 2017 at 8:03
  • As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here. Sep 29, 2017 at 8:14
  • I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant. Sep 29, 2017 at 8:32

1 Answer 1


I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.

Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:

Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"

You may need to wipe your session store to ensure no customers are still sharing sessions.

I found this related question useful and it contains more info over there:

How to Remove SID (SESSION_ID) from URL in Magento 2

  • You're right, thanks, this seems to be the most likely reason since we were sharing urls Oct 10, 2017 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.