Suddenly started using another logged in user's session - Magento 2
This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this.
I was testing some features on my dev server while someone else was logged in on the frontend as well. At one point after refreshing I saw that I was suddenly logged in as the other user's account, I did not even know which email they were using and had never logged in with that account before but I could now do everything from change his password to place orders with his account.
As far as I know I'm not doing anything weird with sessions, but the most likely place I could see this going wrong is a Helper class that is used in various places but that is only used for getting the current user's customer group ID.
It is a fairly standard and clean Magento 2.1.9 installation on a LAMP stack, we started developing two weeks ago so we have one custom module that we are working on right now and no third party modules.
magento2 security session customer-session
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
add a comment |
This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this.
I was testing some features on my dev server while someone else was logged in on the frontend as well. At one point after refreshing I saw that I was suddenly logged in as the other user's account, I did not even know which email they were using and had never logged in with that account before but I could now do everything from change his password to place orders with his account.
As far as I know I'm not doing anything weird with sessions, but the most likely place I could see this going wrong is a Helper class that is used in various places but that is only used for getting the current user's customer group ID.
It is a fairly standard and clean Magento 2.1.9 installation on a LAMP stack, we started developing two weeks ago so we have one custom module that we are working on right now and no third party modules.
magento2 security session customer-session
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32
add a comment |
This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this.
I was testing some features on my dev server while someone else was logged in on the frontend as well. At one point after refreshing I saw that I was suddenly logged in as the other user's account, I did not even know which email they were using and had never logged in with that account before but I could now do everything from change his password to place orders with his account.
As far as I know I'm not doing anything weird with sessions, but the most likely place I could see this going wrong is a Helper class that is used in various places but that is only used for getting the current user's customer group ID.
It is a fairly standard and clean Magento 2.1.9 installation on a LAMP stack, we started developing two weeks ago so we have one custom module that we are working on right now and no third party modules.
magento2 security session customer-session
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this.
I was testing some features on my dev server while someone else was logged in on the frontend as well. At one point after refreshing I saw that I was suddenly logged in as the other user's account, I did not even know which email they were using and had never logged in with that account before but I could now do everything from change his password to place orders with his account.
As far as I know I'm not doing anything weird with sessions, but the most likely place I could see this going wrong is a Helper class that is used in various places but that is only used for getting the current user's customer group ID.
It is a fairly standard and clean Magento 2.1.9 installation on a LAMP stack, we started developing two weeks ago so we have one custom module that we are working on right now and no third party modules.
magento2 security session customer-session
magento2 security session customer-session
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
edited Sep 29 '17 at 8:29
Kaascroissant
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
asked Sep 28 '17 at 9:23
KaascroissantKaascroissant
36215
36215
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32
add a comment |
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32
add a comment |
2 Answers
2
active
oldest
votes
I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.
Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:
Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"
You may need to wipe your session store to ensure no customers are still sharing sessions.
I found this related question useful and it contains more info over there:
How to Remove SID (SESSION_ID) from URL in Magento 2
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
add a comment |
please help me for issue , very important
zangane.mostafa71@gmail.con
i help!!!!!!!!
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "479"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fmagento.stackexchange.com%2fquestions%2f195067%2fsuddenly-started-using-another-logged-in-users-session-magento-2%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.
Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:
Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"
You may need to wipe your session store to ensure no customers are still sharing sessions.
I found this related question useful and it contains more info over there:
How to Remove SID (SESSION_ID) from URL in Magento 2
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
add a comment |
I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.
Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:
Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"
You may need to wipe your session store to ensure no customers are still sharing sessions.
I found this related question useful and it contains more info over there:
How to Remove SID (SESSION_ID) from URL in Magento 2
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
add a comment |
I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.
Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:
Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"
You may need to wipe your session store to ensure no customers are still sharing sessions.
I found this related question useful and it contains more info over there:
How to Remove SID (SESSION_ID) from URL in Magento 2
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
I was able to replicate this issue by clicking a link with a "SID" (session ID) in it. If that session ID belonged to another customer and they were logged in, I could see their details.
Because the site I was working on was a single website/store (no multi-website/store) I could stop the issue by changing:
Store > Configuration > General > Web > Session Validation Settings > "Use SID on Storefront" == "No"
You may need to wipe your session store to ensure no customers are still sharing sessions.
I found this related question useful and it contains more info over there:
How to Remove SID (SESSION_ID) from URL in Magento 2
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
answered Oct 10 '17 at 2:16
WireblueWireblue
1445
1445
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
add a comment |
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
You're right, thanks, this seems to be the most likely reason since we were sharing urls
– Kaascroissant
Oct 10 '17 at 8:00
add a comment |
please help me for issue , very important
zangane.mostafa71@gmail.con
i help!!!!!!!!
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
please help me for issue , very important
zangane.mostafa71@gmail.con
i help!!!!!!!!
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
please help me for issue , very important
zangane.mostafa71@gmail.con
i help!!!!!!!!
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
please help me for issue , very important
zangane.mostafa71@gmail.con
i help!!!!!!!!
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 11 mins ago
zangane.mostafazangane.mostafa
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 11 mins ago
zangane.mostafazangane.mostafa
1
answered 11 mins ago
zangane.mostafazangane.mostafa
1
1
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
zangane.mostafa is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Thanks for contributing an answer to Magento Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fmagento.stackexchange.com%2fquestions%2f195067%2fsuddenly-started-using-another-logged-in-users-session-magento-2%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
It could be a cache issue. Confirm it by going through the checkout. You will not actually order as the other account.
– Fabian Schmengler
Sep 29 '17 at 6:17
I tried and I was able to actually place the orders and change their account information
– Kaascroissant
Sep 29 '17 at 8:03
As Fabian already mentioned: This can be a cache issue (do you use varnish?) or also a session problem. If the session lifetime is very long a session collission can occur. Apart from this I think you need to update your question with some more technical information to get some good answers and help here.
– Anna Völkl
Sep 29 '17 at 8:14
I do not use varnish, the sessions lifetime is a couple of minutes and at most 2 people log in at a time so I don't think it's a session collission. I have updated the question with some information about the version and modules, what other information would be useful to share? I'm not really sure what could cause this so I don't know what might be relevant.
– Kaascroissant
Sep 29 '17 at 8:32