We were previously running a load balancer with a 4gb cloud server and 4gb DB server on the Rackspace Cloud. We were using Ubuntu 10.04 + PHP 5.3.2, EE 2.7.2 + Cartthrob 2.4. Everything was running smoothly on both the EE and CT side of things.
We recently added additional, identical servers to the load balancer (total of 3) and upgraded to PHP 5.3.27 on Ubuntu 12.04. Nothing has changed with our EE or CT code.
On our transaction page, we use CT Ajax calls to add to cart and checkout without the user leaving the page.
Since moving to the new servers, no transactions have been processed. We did some digging and found via the response headers that values were being added to the cart; however on the checkout request, the response returned a exp_cartthrob_session_id instead of exp_session_id.
Because of this mismatch, the system thinks the cart is empty and doesn't allow a transaction to process.
When using a browser that has previously processed a transaction and has cookies stored, we're able to make a sale successfully. When logged in, transactions process successfully. It only returns a cart empty response on machines that have cookies cleared or are in an incognito window.
What We've Tried
- Looked through possible XID issues, but those appear to be updating successfully.
- Checked the db and confirmed a mismatch in session ids: 3 are being created, 2 of which match, and the 3rd that happens on checkout doesn't match.
- Confirmed that all of our php config is identical to the old server.
- Tried multiple fingerprinting methods and cleared out all existing sessions.
- All tests on old server are successfully processed.
Any ideas on what could be causing this?
- Works locally on os x lion + php 5.3.14 & 5.4.4
- Breaks consistently on dev server with ubuntu 12.04 + php 5.3.27 OR php 5.4.21
After further digging, it appears that our sessions/cookies aren't being properly set. They appear in as a response cookie, but never as a request cookie.
We setup a non-ajax form to add to cart + checkout, and found that items are never being added to the cart. In the exp_cartthrob_sessions table, a new row is added on each attempted add to cart.
Because CT runs all commands through XSS filtering and ignores the EE global config, we believe there's a possible issue with the xss filtering of cookies. Our current theory is that the filter function is stripping out needed characters, causing a session mismatch, thus creating a new session. See similar issue: http://ellislab.com/forums/viewthread/237467/
It seems that the issue is only present on Ubuntu 12.04