Hi guys.
I found something that seemed to work perfectly for me, and now I don't see the oscID unless cookies are disabled in my browser.
Here is the post I found that helped me out:
QUOTE
Right guys,
Not 100% up to speed on this yet but after reaching 99% I did do a couple of celebratory laps of the sitting room!! Yes, the sitting room is where I get most of the proper work done - I spent all day at the shop just sorting out orders, replying to probably dead end e-mails and the rest of the standard shop work!! How I am ever going to compete with Amazon I will never know!
Still the major breakthrough has been made, only one potential problem left which I will mention at the end.
Ok, Sessions.....
It would appear to me that a very large number of users do not have OScommerce configured correctly (Including myself). I assumed that every user was issued a (visible) session ID. All the OScommerce sites I had visited, and that is a lot of sites since I have been working on mine, have issued me with a session ID in the URL. Now, this does not need to happen so long as cookies are enabled on the users browser. The 2.2 ms version of OScommerce (dont know about previous versions) is very clever.... Once a new customer visits your site, OSc will try to reply to the customer with cookies enabled, if it does not recieve the response it wants, ie cookies are disabled, then and only then will it assign the user a session ID.
This make sense so far? It took me some bl**dy working out.
Now, knowing that generally speaking sessions are a bad idea security wise for your site/customers (they are open to abuse if another user can access the same open session), OSc will use cookies when it can. You know it is using cookies when the URL does not contain a reet big long OSCid number.
So, what are the correct settings for your config file, I hear you ask!
Well, mine is now,
define('HTTP_SERVER', 'http://www.mydomain.co.uk'); // eg, <http://localhost> - should not be empty for productive servers
define('HTTPS_SERVER', 'https://www.mydomain.co.uk'); // eg, <https://localhost> - should not be empty for productive servers
define('ENABLE_SSL', true); // secure webserver for checkout procedure?
define('HTTP_COOKIE_DOMAIN', 'mydomain.co.uk');
define('HTTPS_COOKIE_DOMAIN', 'mydomain.co.uk');
define('HTTP_COOKIE_PATH', '/');
define('HTTPS_COOKIE_PATH', '/');
And all appears well. I would say things get a little more confusing if you are on a shared SSL but if anyones interested I could probably find and post the answers here later (when I get a spare five minutes!)
OK, so to summarise so far, if, in your admin you have FORCE COOKIE USE set to FALSE, any users with cookies enabled should see a nice short URL and if the customer has cookies disabled they will see a chuffing great long URL with a session id tagged on the end.
So going back to my original post about how to set up the SESSIONS in admin, I guess its better to not set FORCE COOKIE USE to true, as this will certainly prevent AOL users, amongst others from accessing your shop (Cheers Rhea for that pointer).
Everything I have read indicates that PREVENT SPIDER SESSIONS must be set to TRUE as a matter of security.
As far as the rest of the settings go, not sure yet!! Will try and do a bit more reading.
If I am going over old ground for you experienced hands, please put me out of my misery and save me a bit of time by letting me know the best set up!
Right, after creating the worlds longest post tonight I think I am going to clear off to bed - The only thing left to explain is why I have not implemented these new settings on my site. Well, it all boils down to my old friend the HSBC secure e-payments!! I have hard coded (I think thats the correct techie term) a session id into the return post from the HSBC site, Doh!! It was the only way I could get it working at the time. Now, how this is going to be affected by using cookies I am not quite sure and am certainly not prepared to think about or try to change after a half a bottle of Johnny Walker - Thats a job for another day (when I get another spare five minutes).
Cheers for now.
Richard.
Regards
Itai
