forces me to turn on cookies - followed instructions - fail

**joey** · 08-23-2003, 04:47 AM

I get this

Cookies must be enabled to purchase online on this store to embrace privacy and security related issues regarding your visit to this site.

By enabling cookie support on your browser, the communication between you and this site is strengthened to be certain it is you who are making transactions on your own behalf, and to prevent leakage of your privacy

Followed instructions and then the above came up again - cannot get past

running on localhost any problem?

Anonymous · 08-23-2003, 10:42 AM

I had the same problem so I just turned it off

**michael_s** · 08-23-2003, 11:23 AM

It is a problem with your cookie domain path. The easiest workaround on a test server is to turn of 'Force Cookies' in the admin under sessions.

**joey** · 08-23-2003, 01:58 PM

turned it off and it still asks!!!

**michael_s** · 08-23-2003, 02:32 PM

Clear your browser cache, close all open browser windows. Then re-open your browser. It should work.

Anonymous · 08-29-2003, 01:59 AM

A friend told me this may work, however it introduces the old sessions in URL bug/security flaw in that potential hackers can emulate somebody else's order, grab their card details, personal addresses, and other personal information.

To what extend this statement is true? and how serious is it ?
Scary

TIA

**michael_s** · 08-29-2003, 07:50 AM

Well, the risk is fairly low, especially if you move the session storage path to something in your restricted webspace (not web accessable). Yes there is a security risk with session ID's, but if you are using shared SSL, there is no other way, since the cookie domain changes, osCommerce will set 2 different cookies, and you will not be able to checkout, even if you get past the 'enable cookies' page.

Anonymous · 08-29-2003, 11:06 PM

i do also hav this cookie problem, and it only cccurs when i use MS2-MAX but its not with 2.2 MS1 why is that so.

**hussain** · 08-29-2003, 11:56 PM

i commented the following lines in \includes\application_top.php but still it is redirecting to cookie_usage.php page,why.

//redirect the customer to a friendly cookie-must-be-enabled page if cookies are disabled
// if ($session_started == false) {
// tep_redirect(tep_href_link(FILENAME_COOKIE_USAGE)) ;
//}