Session page setup

[gmancommerce]

Hi there,

I would like to ask what is the good practice for session page:

Here is my setup:

Session Directory /tmp
Force Cookie Use False
Check SSL Session ID True
Check User Agent True
Check IP Address True
Prevent Spider Sessions True
Recreate Session True

The reason why I have this setup because the oscid show up in the URL, if the user check out and send the URL to another user (Let said User B), User B can view all the address information just simply click the link.

My temporary solution is setup the session page like above. It is partially working. However, now, whenever people send the URL, it will go to login page regarding if she is login or not.

Is there any way I can do the following:
1) If it is not checkout, I can still send the URL and share the product information
2) If it is checkout, I want to have login page show up when I pass the URL to protect the user privacy.

Any advice is welcome.

Thanks

[jpf]

Session Directory /tmp -NA use MySQL!!
Force Cookie Use - YES!!!!!


Without cookie there will be some (cookie restriction) will see SID.


Also use htaccess and mod rewrite with the SEO option in osCMax will remove the standard URL.

[gmancommerce]

Hi Jpf,

Thanks for your reply, yes I know cookie will help, however, it can't used with Shared SSL. We need to purchase a dedicated SSL and dedicated IP for this.

I will take a look on htacess and SEO option.

Thanks for your reference.

[JohnW]

On a shared server just using /tmp is a security risk because it is possible for others to access it. Purchasing a SSL is money well spent and really you'll make the make the money back on it through sales you would otherwise lose for not having one.

[pgmarshall]

Anyone who wants to set their sessions to be in MySQL ...

Goto the configure.php file in catalog/includes/ and near the bottom change this line to look like this.

define('STORE_SESSIONS', 'mysql');

Regards,

[gmancommerce]

Thanks for all response

define('STORE_SESSIONS', 'mysql'); is a current setup, and agree with JohnW's advice.

[JohnW]

If this site ever has an award for the most typos I might just win win

[ridexbuilder]

Dunno what you what you mean.