{"action":"created","issue":{"url":"https://api.github.com/repos/woocommerce/woocommerce/issues/17292","repository_url":"https://api.github.com/repos/woocommerce/woocommerce","labels_url":"https://api.github.com/repos/woocommerce/woocommerce/issues/17292/labels{/name}","comments_url":"https://api.github.com/repos/woocommerce/woocommerce/issues/17292/comments","events_url":"https://api.github.com/repos/woocommerce/woocommerce/issues/17292/events","html_url":"https://github.com/woocommerce/woocommerce/issues/17292","id":266891081,"number":17292,"title":"Ajax Cart/Login session issue","user":{"login":"aboeglin","id":8297302,"avatar_url":"https://avatars0.githubusercontent.com/u/8297302?v=4","gravatar_id":"","url":"https://api.github.com/users/aboeglin","html_url":"https://github.com/aboeglin","followers_url":"https://api.github.com/users/aboeglin/followers","following_url":"https://api.github.com/users/aboeglin/following{/other_user}","gists_url":"https://api.github.com/users/aboeglin/gists{/gist_id}","starred_url":"https://api.github.com/users/aboeglin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aboeglin/subscriptions","organizations_url":"https://api.github.com/users/aboeglin/orgs","repos_url":"https://api.github.com/users/aboeglin/repos","events_url":"https://api.github.com/users/aboeglin/events{/privacy}","received_events_url":"https://api.github.com/users/aboeglin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-10-19T15:42:32Z","updated_at":"2017-10-20T16:54:47Z","closed_at":"2017-10-20T16:25:01Z","author_association":"NONE","body":"## The problem\r\n\r\nI build a theme with custom ajax functions for login/logout and cart. The problem is, that all users seem to share the same cart. I suppose it has something to do with the cookies. The session seems to be reset properly on the logout, and the cart is being emptied. When the user logs out, I call my cart ajax function to get the current cart with WC()->cart->get_cart(). It returns an empty cart as it should. But if I reload the page 2 times, I suddenly have a cart with items in it, that seem to be shared with users ( whether they are logged in or not ). I have no idea where that information is coming from and how to narrow it down. I have been reading most of the code concerning the WC classes related to session and cart, but couldn't find anything really.\r\n\r\nI find it really hard to find informations in the documentation about how to go for these things and most of it comes down to reading the source. I'm not sure if it is a bug, or my misunderstanding, but if anyone could give me some pointers to track this down. Like, where in the database things are stored, and what calls store the sessions, it would be amazing.\r\n\r\nedit: Also, if I go in the admin, and clear the customer sessions in the tools, the cart is not being reset. \r\n\r\nedit2: I think I could finally narrow it down, and it seems that API calls to /products/categories and /products/<id>/variations return Set-Cookie headers, that contain a woocommerce_cart_hash which is shared among all users ( anonymous or authenticated ). The cookie wp_woocommerce_session_18ec75d53bef8652813cf1515e5cfc08 seems to be different for every user. Why would a call to the REST API set cookies ?\r\n\r\n## WordPress Environment\r\n\r\n<details>\r\n```\r\n`\r\n### WordPress Environment ###\r\n\r\nHome URL: https://shakashop.fr\r\nSite URL: https://shakashop.fr\r\nWC Version: 3.2.1\r\nLog Directory Writable: ✔\r\nWP Version: 4.8.2\r\nWP Multisite: –\r\nWP Memory Limit: 512 MB\r\nWP Debug Mode: –\r\nWP Cron: ✔\r\nLanguage: fr_FR\r\n\r\n### Server Environment ###\r\n\r\nServer Info: Apache\r\nPHP Version: 5.6.31\r\nPHP Post Max Size: 130 MB\r\nPHP Time Limit: 300\r\nPHP Max Input Vars: 16000\r\ncURL Version: 7.38.0\r\nOpenSSL/1.0.1t\r\n\r\nSUHOSIN Installed: –\r\nMySQL Version: 5.6.34\r\nMax Upload Size: 128 MB\r\nDefault Timezone is UTC: ✔\r\nfsockopen/cURL: ✔\r\nSoapClient: ✔\r\nDOMDocument: ✔\r\nGZip: ✔\r\nMultibyte String: ✔\r\nRemote Post: ✔\r\nRemote Get: ✔\r\n\r\n### Database ###\r\n\r\nWC Database Version: 3.2.1\r\nWC Database Prefix: wp_\r\nMaxMind GeoIP Database: ✔\r\nTotal Database Size: 1.72MB\r\nDatabase Data Size: 0.84MB\r\nDatabase Index Size: 0.88MB\r\nwp_woocommerce_sessions: Data: 0.02MB + Index: 0.02MB\r\nwp_woocommerce_api_keys: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_attribute_taxonomies: Data: 0.02MB + Index: 0.02MB\r\nwp_woocommerce_downloadable_product_permissions: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_order_items: Data: 0.02MB + Index: 0.02MB\r\nwp_woocommerce_order_itemmeta: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_tax_rates: Data: 0.02MB + Index: 0.06MB\r\nwp_woocommerce_tax_rate_locations: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_shipping_zones: Data: 0.02MB + Index: 0.00MB\r\nwp_woocommerce_shipping_zone_locations: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_shipping_zone_methods: Data: 0.02MB + Index: 0.00MB\r\nwp_woocommerce_payment_tokens: Data: 0.02MB + Index: 0.02MB\r\nwp_woocommerce_payment_tokenmeta: Data: 0.02MB + Index: 0.03MB\r\nwp_woocommerce_log: Data: 0.02MB + Index: 0.02MB\r\nwp_commentmeta: Data: 0.02MB + Index: 0.03MB\r\nwp_comments: Data: 0.02MB + Index: 0.08MB\r\nwp_links: Data: 0.02MB + Index: 0.02MB\r\nwp_options: Data: 0.19MB + Index: 0.02MB\r\nwp_postmeta: Data: 0.14MB + Index: 0.14MB\r\nwp_posts: Data: 0.05MB + Index: 0.06MB\r\nwp_termmeta: Data: 0.02MB + Index: 0.03MB\r\nwp_terms: Data: 0.02MB + Index: 0.03MB\r\nwp_term_relationships: Data: 0.02MB + Index: 0.02MB\r\nwp_term_taxonomy: Data: 0.02MB + Index: 0.03MB\r\nwp_usermeta: Data: 0.02MB + Index: 0.03MB\r\nwp_users: Data: 0.02MB + Index: 0.05MB\r\n\r\n### Post Type Counts ###\r\n\r\nattachment: 20\r\npage: 6\r\npost: 2\r\nproduct: 7\r\nproduct_variation: 37\r\nrevision: 3\r\nshop_order: 3\r\nshop_webhook: 1\r\n\r\n### Security ###\r\n\r\nSecure connection (HTTPS): ✔\r\nHide errors from visitors: ✔\r\n\r\n### Active Plugins (1) ###\r\n\r\nWooCommerce: par Automattic – 3.2.1\r\n\r\n### Settings ###\r\n\r\nAPI Enabled: ✔\r\nForce SSL: –\r\nCurrency: EUR (€)\r\nCurrency Position: right\r\nThousand Separator: \r\nDecimal Separator: ,\r\nNumber of Decimals: 2\r\nTaxonomies: Product Types: external (external)\r\ngrouped (grouped)\r\nsimple (simple)\r\nvariable (variable)\r\n\r\nTaxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)\r\nexclude-from-search (exclude-from-search)\r\nfeatured (featured)\r\noutofstock (outofstock)\r\nrated-1 (rated-1)\r\nrated-2 (rated-2)\r\nrated-3 (rated-3)\r\nrated-4 (rated-4)\r\nrated-5 (rated-5)\r\n\r\n\r\n### WC Pages ###\r\n\r\nBase boutique: #4 - /boutique/\r\nPanier: #5 - /panier/\r\nCommande: #6 - /commande/\r\nMon compte: #7 - /mon-compte/\r\nTerms and conditions: ❌ Page non définie\r\n\r\n### Theme ###\r\n\r\nName: Shakaponk\r\nVersion: – 0 est disponible\r\nAuthor URL: \r\nChild Theme: ✔\r\nParent Theme Name: Storefront\r\nParent Theme Version: 2.2.5\r\nParent Theme Author URL: https://woocommerce.com/\r\nWooCommerce Support: ✔\r\n\r\n### Templates ###\r\n\r\nOverrides: shakashop/woocommerce/single-product.php version - est obsolète. La version du noyau est 1.6.4\r\nOutdated Templates: ❌Apprenez comment mettre à jour\r\n`\r\n```\r\n</details>\r\n"},"comment":{"url":"https://api.github.com/repos/woocommerce/woocommerce/issues/comments/338262783","html_url":"https://github.com/woocommerce/woocommerce/issues/17292#issuecomment-338262783","issue_url":"https://api.github.com/repos/woocommerce/woocommerce/issues/17292","id":338262783,"user":{"login":"mikejolley","id":90977,"avatar_url":"https://avatars2.githubusercontent.com/u/90977?v=4","gravatar_id":"","url":"https://api.github.com/users/mikejolley","html_url":"https://github.com/mikejolley","followers_url":"https://api.github.com/users/mikejolley/followers","following_url":"https://api.github.com/users/mikejolley/following{/other_user}","gists_url":"https://api.github.com/users/mikejolley/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejolley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejolley/subscriptions","organizations_url":"https://api.github.com/users/mikejolley/orgs","repos_url":"https://api.github.com/users/mikejolley/repos","events_url":"https://api.github.com/users/mikejolley/events{/privacy}","received_events_url":"https://api.github.com/users/mikejolley/received_events","type":"User","site_admin":false},"created_at":"2017-10-20T16:54:47Z","updated_at":"2017-10-20T16:54:47Z","author_association":"OWNER","body":"API requests are ran by a user (who owns the key). How are these requests being made? From where?"}}
{"actor":{"display_login":"mikejolley"}}