woothemes/woocommerce — Issue #253: Option to clear session data after log-out
Author: paulhastings0
Created: 2011-11-22 22:19:55+00:00
State: open

We discovered the following issue which might be a feature or a bug, depending on how you look at it. My recommendation would be a checkbox in the Settings page where the site admin can choose to have Session Data cleared upon log-out (by deleting the PHPSESSID cookie)

============

If User 1 is logged in, adds products to the cart, and then applies a coupon, but then logs out of the site before checking out then their cart data is accessible to User 2 if User 1 doesn't shut down the browser.

When User 2 logs into the site their cart is automatically populated with all of User 1's items, including User 1's coupons.

============

While this isn't really a security bug, it might be perceived as a privacy bug. I know that some users would be uncomfortable with other people knowing what they were about to order. Likewise, shop owners may not like the idea that User 2 could use a coupon that was entered by User 1 before they logged out.

However, I can also see the advantage of having session data persist. I think the best of both worlds would be to let the shop owner choose whether or not to let the session data persist.

I just checked out Amazon.com and they seem to handle it a little differently. When the user logs out, their shopping cart data isn't available to someone else who logs in.

I just checked out Amazon.com and they seem to handle it a little differently. The data seems to be stored independently of browser cookies, so I'm not sure what's up with that.