Session lost with SSL after 1.9.1 upgrade

Question

Since Magento upgrade 1.9.1 we are getting session lost issues when we have SSL enabled on frontend. This is when going back to magento after payment gateway site.

I understand that the "security" has been improved in this release and I'm wondering what that actually means.

Answer 1

Seems like I found the problem:

app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

The following code was added:

if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
            // secure cookie check to prevent MITM attack
            $secureCookieName = $sessionName . '_cid';
            if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
                && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
            ) {
                session_regenerate_id(false);
                $sessionHosts = $this->getSessionHosts();
                $currentCookieDomain = $cookie->getDomain();
                foreach (array_keys($sessionHosts) as $host) {
                    // Delete cookies with the same name for parent domains
                    if (strpos($currentCookieDomain, $host) > 0) {
                        $cookie->delete($this->getSessionName(), null, $host);
                    }
                }
                $_SESSION = array();
            }
            if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
                $checkId = Mage::helper('core')->getRandomString(16);
                $cookie->set($secureCookieName, $checkId, null, null, null, true);
                $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
            }
        }

I'll try to find a workaround for this...

UPDATE:

We managed a workaround by reloading the saved quote from a GET param on the callback URL, something like this:

if($this->getOnepage()->getQuote()->getId() == null){
                            $rqQuoteId = Mage::app()->getRequest()->getParam('qid');
                            $this->getOnepage()->setQuote(Mage::getModel('sales/quote')->loadActive($rqQuoteId));
                            $customer_id = $this->getOnepage()->getQuote()->getData('customer_id');
                            if(!is_null($customer_id)){
                                $customer = Mage::getModel('customer/customer')->load($customer_id);
                                if(!is_null($customer)){
                                    Mage::getSingleton('customer/session')->setCustomerAsLoggedIn($customer);
                                }
                            }
                        }

Have in mind that this would represent a security risk if anyone can run that URL, make sure it can only be ran once. If you are saving custom data on the session you'll need to save it on the db, and reload it afterwards. Hope it helps.

Answer 2

I found the issue and located it in this file:

app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

In order to fix it more elegantly one should override the specified file in the "local" code pool insted of modifying the core directly. Like below:

app/code/local/Mage/Core/Model/Session/Abstract/Varien.php

Also for the above to work php.ini setting session.cookie_secure must be commented or set to 0.