In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or location).
It is almost as if the details have been held on the server cache. Has anyone had this issue before. Needless to say the customers have been very concerned (and one even threatening!). The whole of our Magento (all pages are SSL/https )

  • 1. Are you using any third party caching or extension that affect customer account creation? Nov 23, 2014 at 17:22
  • 2. Is the customer info only showing up at checkout or are they saved in the the customer address book (in my account)? Nov 23, 2014 at 17:24
  • 3. Does the customer cart content also changes when this happen or just address? Nov 23, 2014 at 17:24
  • 4. Any relationship between the customer e.g signup or checking out around the same time? Nov 23, 2014 at 17:27
  • 5. Is it the same customer info showed up on all account? Nov 23, 2014 at 17:27

1 Answer 1


Content sharing can be caused by a number of things,

  • Session sharing
    • Poor session validation
    • SID in URL (combined with the above)
  • Caching
    • Full page cache modules
    • Reverse cache (Varnish/Nginx etc.)

Session sharing

If the user "becomes" another customer completely. Ie. They suddenly are logged in as another user. Then it is caused by session sharing.


This can be caused by a number of factors, usually weak session validation settings. Magento has four settings for session validation that IIRC are all disabled by default.


Start by turning on remote address validation, this setting on its own works well - but there are some cases where the same public IP will be used by multiple users (ie. Carrier grade NAT - which is becoming increasingly more popular with the diminishing IPv4 resources).

Then continue to enable the other settings one by one if issues persist.


If your user only sees someone else's information on a single page, but when they click to another they no longer do - it's a cache issue.


This can be caused by the core block cache in Magento (if the cache keys have modified to remove the customer specific fields), by full page caching modules (even EE's FPC is guilty of this), by third party caching modules and last of all by reverse proxy caches.


You'll need to identify the cause,

  • If you have a third party caching module, remove it.
  • If you are using Varnish/Nginx/Apache to cache, turn it off.
  • If you are using EE FPC, turn it off.
  • If you have modified the core, restore a clean copy.
  • If you are using any other third party modules, disable one by one until the issue is gone.

There's a common misconception that HTTPS can/should not be cached, ignore it.

You can certainly cache HTTPS without issue, its identical to HTTP, just note the same common sense rules apply - don't cache a page with unique customer data on it.

Annoyingly, this is a very real side effect of deploying Varnish without being fully aware of the huge risks/dangers it poses when incorrectly configured (which in 99% of cases, it is).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.