Our setup

We were previously running a load balancer with a 4gb cloud server and 4gb DB server on the Rackspace Cloud. We were using Ubuntu 10.04 + PHP 5.3.2, EE 2.7.2 + Cartthrob 2.4. Everything was running smoothly on both the EE and CT side of things.

We recently added additional, identical servers to the load balancer (total of 3) and upgraded to PHP 5.3.27 on Ubuntu 12.04. Nothing has changed with our EE or CT code.

On our transaction page, we use CT Ajax calls to add to cart and checkout without the user leaving the page.

The Issue

Since moving to the new servers, no transactions have been processed. We did some digging and found via the response headers that values were being added to the cart; however on the checkout request, the response returned a exp_cartthrob_session_id instead of exp_session_id.

Because of this mismatch, the system thinks the cart is empty and doesn't allow a transaction to process.

When using a browser that has previously processed a transaction and has cookies stored, we're able to make a sale successfully. When logged in, transactions process successfully. It only returns a cart empty response on machines that have cookies cleared or are in an incognito window.

What We've Tried

  • Looked through possible XID issues, but those appear to be updating successfully.
  • Checked the db and confirmed a mismatch in session ids: 3 are being created, 2 of which match, and the 3rd that happens on checkout doesn't match.
  • Confirmed that all of our php config is identical to the old server.
  • Tried multiple fingerprinting methods and cleared out all existing sessions.
  • All tests on old server are successfully processed.

Any ideas on what could be causing this?

Update: 11.18.2013

  • Works locally on os x lion + php 5.3.14 & 5.4.4
  • Breaks consistently on dev server with ubuntu 12.04 + php 5.3.27 OR php 5.4.21

After further digging, it appears that our sessions/cookies aren't being properly set. They appear in as a response cookie, but never as a request cookie.

We setup a non-ajax form to add to cart + checkout, and found that items are never being added to the cart. In the exp_cartthrob_sessions table, a new row is added on each attempted add to cart.

Because CT runs all commands through XSS filtering and ignores the EE global config, we believe there's a possible issue with the xss filtering of cookies. Our current theory is that the filter function is stripping out needed characters, causing a session mismatch, thus creating a new session. See similar issue: http://ellislab.com/forums/viewthread/237467/

It seems that the issue is only present on Ubuntu 12.04


After a few weeks of attempting to track down this bug, we finally found the culprit was misconfigured cookie_domain setting.

In our config file, we dynamically set the cookie domain so cookies work with our various MSM sites:

$config['cookie_domain']            = '.' . preg_replace('#^www\.(.+\.)#i', '$1', $_SERVER['HTTP_HOST']);

During our server switch, we began using RightScale templates to dynamically create our msm index.php files. The new templates wrongly included the malformed cookie_domain config:

$assign_to_config['cookie_domain'] = '*.sub.domainname.com'

Because the cookie was being set for a non-existent tertiary domain, the cookie never matched, thus the cart technically didn't exist.

After removing the incorrect cookie_domain from our MSM index files, the issue was resolved.

So, if you're having similar issues, make sure your cookies are set properly!

  • Great job tracking that down!
    – Anna_MediaGirl
    Nov 19 '13 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.