WooCommerce customer login: Litespeed Cache with ESI

  • Resolved ataypamart

    (@ataypamart)


    1 year, 5 months ago

    Hey

    I have encountered an issue that looked very much like a random bug, until after a long investigation work i figured out a relatively simple path to replicate the issue. The conditions for the bug are litespeed with ESI activated on a woocommerce site (i have updated to litespeed plugin latest version v6.3, no change).

    Here is the simplest path I could find to replicate the issue:

    • start from a fresh browser state (significant, the bug seems to lie at the intersection between nonces and cookies).
    • go to the woocommerce shop, select a product and add to cart
    • from cart or minicart, remove the product (which clears the woocommerce session)
    • go then to the woocommerce account login page

    at this point, any attempt to login will fail (w/o even processing the credentials; my interpretation is that the woocommerce login nonce is off, and there is a shortcut in how woocommerce handes the form that short circuit when the nonce is off; i cannot prove it since this is on a test site where i cannot debug as easily as on localhost).

    When clearing the browser state (clearing all cookies), and going directly to the woocommerce login page, the login form works again as expected.

    Now when deactivating ESI, the same path works well, so this appears related to the ESI support. Activating the litespeed debug logs show that LS seems to do something clever with (a subset of) the nonces, and in particular it processes the woocommerce login nonce. This is a bit unexpected since the woocommerce account page is (correctly) detected as non cacheable, so I am not clear why ESI are still playing with the contents the page.

    I don’t think there is anything specific to the website i am developing that would explain this behaviour, but it is difficult to say for sure (eg the template for the login page is slighlty custom, but the important bits are copied from woocommerce code).

    Can you please kindly advise?

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support qtwrk

    (@qtwrk)

    1 year, 5 months ago

    please provide the report number

    you can get it in toolbox -> report -> click “send to LiteSpeed”

    and when it fails to login , do you see any error message or warning in browser dev tool ?

    Thread Starter ataypamart

    (@ataypamart)

    1 year, 5 months ago

    Fail to login: no console message if that is what you mean. There is a clear roundtrip with the server (ie form is clearly submitted, and i can see the contents of the form in the dev tool, when looking at the network tab).

    Report GRWPQMOL

    NB: Since I posted the original message, I managed to add a simple error_log() trace in WC_Form_Handler::process_login() and I can confirm that when WooCommerce tries to validate the nonce which is part of the login form, ie wp_verify_nonce( $nonce_value, ‘woocommerce-login’ ) the nonce is considered invalid, so that process_login() short circuits and returns without even looking at the credentials provided.

    Thread Starter ataypamart

    (@ataypamart)

    1 year, 5 months ago

    The plot thickens. More precisely: the issue reported above is correct, but since i am trying to provide a clean path (starting from a cache entirely rebuilt, clean browser session), there are missing prior steps.

    • Clear the LS cache entirely (using the “clear all” action)
    • (Not sure if it is significant) use crawler to rebuild clean cached static pages
    • Use the “My Account” page to login once and logoff (this is where the mystery thickens: my interpretation is that this step has a stale nonce enter the LS cache somehow).
    • Then the steps above starting with “start from a fresh browser state…” will led to the outcome. This step can be repeated and will always fail.

    There is probably a simpler way to get a systematic (ie non random) behaviour, but i did not find it yet. You can also see why this is more likely to occur “randomly” in a test environment — ie this is a bit of a corner case.

    Plugin Support qtwrk

    (@qtwrk)

    1 year, 5 months ago

    nonce won’t “stale” in case like that, as you were testing in few minutes , rather than days apart

    for WP , a nonce will have 12- 24 hours validity , unless you were testing at exact moment where nonce becomes invalidated ( 2 checks per day) , but I don’t think that is the case.

    but this is an interesting issue , please create a ticket by mail to support at litespeedtech.com with reference link to this topic , we will investigate futher.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘WooCommerce customer login: Litespeed Cache with ESI’ is closed to new replies.