Full Page Cache in our Cluster users are able to see other users accounts

Question

When I turn on Full Page Cache in our Cluster users are able to see other users accounts.

We are using REDIS for Objects and FPC now (Separate instances) I switch sessions to the database We have 4 web heads and one database server Magento Enterprise 1.13.1 Use SID on Frontend is set to NO NOTE: I am using two different REDIS instances on two different ports. I XX'd out the url and the port number. The problem IS NOT with REDIS as we had this same problem with storing via FILES and with a different theme

I confirmed I was getting traffic to the FPC REDIS instance (We are using Object Rocket)

   <session_save><![CDATA[db]]></session_save>
    <cache>
       <backend><![CDATA[Mage_Cache_Backend_Redis]]></backend>
        <backend_options>
        <server><![CDATA[xxxxxxxxxxxxxxxxxx.rackspaceclouddb.com]]></server>
       <port><![CDATA[xxx12]]></port>
        <database><![CDATA[0]]></database>
        <password>LikeIWillPublishthePassword</password>
       <force_standalone><![CDATA[0]]></force_standalone>
       <automatic_cleaning_factor><![CDATA[0]]></automatic_cleaning_factor> 
      <compress_data><![CDATA[1]]></compress_data>
      <compress_tags><![CDATA[1]]></compress_tags> 
      <compress_threshold><![CDATA[20480]]></compress_threshold>
      <compression_lib><![CDATA[gzip]]></compression_lib>
     <lifetimelimit><![CDATA[43200]]></lifetimelimit>
    </backend_options>
    </cache>

Here is the added XML for the Enterprise FPC

<config>
    <global>
        <cache>
            <request_processors>
                <ee>Enterprise_PageCache_Model_Processor</ee>
            </request_processors>
            <frontend_options>
                <slab_size>1040000</slab_size>
            </frontend_options>
        </cache>
        <full_page_cache>
            <backend>Mage_Cache_Backend_Redis</backend>
            <backend_options>
            <server>7xxxxxxxxxxxxxxxxublb.rackspaceclouddb.com</server>  
              <port>xxxxxxxx31</port>
              <persistent></persistent>                 
           <database>0</database>  
               <password>SomePassword</password>
              <force_standalone>0</force_standalone>
              <connect_retries>1</connect_retries>    
              <lifetimelimit>57600</lifetimelimit> 
              <compress_data>0</compress_data>
            </backend_options>
         </full_page_cache>
    </global>
</config>

(I used the Inchoo Example for FPC)

Please let me know if I forgot something. The only thing that I could think of is if the web heads didn't get all the relevant XML after we published the new enterprise file

EDIT FROM CLIENT:

I just first noticed on the home page but I was actually able to click on on /customer/account and see the other person's recent orders

Answer 1

Magento support found the answer: the problem

CE themes on EE installs and all of them were related to templates. The CE block doesn't have an FPC placeholder, so it will be cached one time and will be shared before other customers.

The code should be moved into an independent block and named as "welcome".

According to the config of the Full Page Cache block "Welcome" has a placeholder which does not cache this block, so that this block is unique per customer.

app/code/core/Enterprise/PageCache/etc/cache.xml (lines 62-67)

<welcome_message>
    <block>page/html_welcome</block>
    <placeholder>WELCOME</placeholder>
    <container>Enterprise_PageCache_Model_Container_Welcome</container>
    <cache_lifetime>86400</cache_lifetime>
</welcome_message>

For example, in the original template:

app/design/frontend/enterprise/default/template/page/html/header.phtml (lines 31-35)

<div class="header-panel">
    <div class="switches"><?php echo $this->getChildHtml('switches') ?></div>
    <p class="welcome-msg"><?php echo $this->getChildHtml('welcome') ?></p>
    <?php echo $this->getChildHtml('accountLinks') ?>
</div>

i.e. the welcome block is used as a child of the header's block, because app/design/frontend/enterprise/default/layout/page.xml (lines 71-88)

 <block type="page/html_header" name="header" as="header">
 <block type="page/template_links" name="account.links" as="accountLinks"/>
                ...
 <block type="page/html_wrapper" name="top.container" as="topContainer" translate="label">
  <label>Page Header</label>
  <action method="setElementClass"><value>top-container</value></action>
  </block>
  <block type="page/html_welcome" name="welcome" as="welcome"/>
    </block>

Answer 2

This could be any number of things but here's a list of possibilities to rule out:

1. Ensure any custom blocks are being added to the Enterprise_PageCache config as follows:

   <!-- My_Module/etc/cache.xml -->  
   <config>  
       <placeholders>  
           <cart_sidebar>  
               <block>custom_module/cart_sidebar</block>
               <placeholder>CART_SIDEBAR</placeholder>
               <container>Enterprise_PageCache_Model_Container_Sidebar_Cart</container>
               <cache_lifetime>86400</cache_lifetime>
           </cart_sidebar>
       </placeholders>
   </config>  
   

2. Ensure no third party services are caching HTML (services like Squixa sometimes accelerate websites this way)

3. Try disabling APC or Zend OPcache if one is enabled (recently had some issues with this)