3

Since Magento upgrade 1.9.1 we are getting session lost issues when we have SSL enabled on frontend. This is when going back to magento after payment gateway site.

I understand that the "security" has been improved in this release and I'm wondering what that actually means.

  • Where are you saving your sessions to? – brentwpeterson Dec 12 '14 at 16:09
  • It's not happening on a certain store, several of our customers are experiencing this. Sessions are usually saved in magento files. We are the developers of the payment gateway extension and we started getting this after 1.9.1 upgrade. – Martín Gaibisso Dec 15 '14 at 13:39
  • Same issue seems to be occurring here: freelancer.com/projects/PHP-Magento/… – Martín Gaibisso Dec 15 '14 at 14:06
  • Are you saving sessions to Files, DB or other? You said "Usually" – brentwpeterson Dec 15 '14 at 14:07
  • 1
    Colin Mollenhour has released modification for this issue. I think this solved this issue better. gist.github.com/colinmollenhour/… – Łukasz L. Jun 14 '16 at 14:25
0

Seems like I found the problem:

app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

The following code was added:

if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
            // secure cookie check to prevent MITM attack
            $secureCookieName = $sessionName . '_cid';
            if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
                && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
            ) {
                session_regenerate_id(false);
                $sessionHosts = $this->getSessionHosts();
                $currentCookieDomain = $cookie->getDomain();
                foreach (array_keys($sessionHosts) as $host) {
                    // Delete cookies with the same name for parent domains
                    if (strpos($currentCookieDomain, $host) > 0) {
                        $cookie->delete($this->getSessionName(), null, $host);
                    }
                }
                $_SESSION = array();
            }
            if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
                $checkId = Mage::helper('core')->getRandomString(16);
                $cookie->set($secureCookieName, $checkId, null, null, null, true);
                $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
            }
        }

I'll try to find a workaround for this...

UPDATE:

We managed a workaround by reloading the saved quote from a GET param on the callback URL, something like this:

if($this->getOnepage()->getQuote()->getId() == null){
                            $rqQuoteId = Mage::app()->getRequest()->getParam('qid');
                            $this->getOnepage()->setQuote(Mage::getModel('sales/quote')->loadActive($rqQuoteId));
                            $customer_id = $this->getOnepage()->getQuote()->getData('customer_id');
                            if(!is_null($customer_id)){
                                $customer = Mage::getModel('customer/customer')->load($customer_id);
                                if(!is_null($customer)){
                                    Mage::getSingleton('customer/session')->setCustomerAsLoggedIn($customer);
                                }
                            }
                        }

Have in mind that this would represent a security risk if anyone can run that URL, make sure it can only be ran once. If you are saving custom data on the session you'll need to save it on the db, and reload it afterwards. Hope it helps.

0

I found the issue and located it in this file:

app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

In order to fix it more elegantly one should override the specified file in the "local" code pool insted of modifying the core directly. Like below:

app/code/local/Mage/Core/Model/Session/Abstract/Varien.php

Also for the above to work php.ini setting session.cookie_secure must be commented or set to 0.

  • That would work, but I don't advice modifying the core, even if you are creating an override in the local folder. I'd take that as a last resort. – Martín Gaibisso Apr 6 '15 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.