Support » Plugin: SG Optimizer » Woocommerce session cookie causes Cache BYPASS

  • Resolved gbruzzo

    (@gbruzzo)


    Hello there,

    This question / post builds on post https://wordpress.org/support/topic/x-proxy-cache-bypass-what-causes-it/

    I am working on a test site with absolutely minimal plugin deployment (WP + WC + Storefront theme) and no users ever logged in.

    I noticed that Cache BYPASS is being triggered when cookie

    wp_woocommerce_session_………………. is present.

    To replicate, step by step :

    1. empty all browser cache and all server cache in admin;

    2. go to shop page (see https://www.densesignals.com/releases) => x-cache MISS

    3. refresh => x-cache HIT (so far, so good!)

    4. Choose any product, click go to product page, add product to cart => Cookies : woocommerce_items_in_cart,
    woocommerce_cart_hash,
    wp_woocommerce_session_……………….

    are stored

    5. go back to https://www.densesignals.com/releases => x-cache BYPASS

    6. remove item from cart (via the header cart) => Cookies : woocommerce_items_in_cart woocommerce_cart_hash are removed, wp_woocommerce_session_………………. is still stored

    7. refresh page => x-cache BYPASS

    8. close the browser / reopen the browser, go to https://www.densesignals.com/releases => x-cache BYPASS

    9. refresh page => x-cache BYPASS

    10. manually remove cookie wp_woocommerce_session_………………. OR dump all browser cache (cookies included), refresh page => x-cache HIT

    I am confused, as I thought you did not BYPASS when wp_woocommerce_session_…. was stored (see https://wordpress.org/support/topic/woocommerce-setup-2/ but maybe that was a long time ago)

    Conclusion:

    Cache is bypassed whenever the Woocommerce Session cookie is present .

    If confirmed, this would be a serious issue for us, because,

    – if a guest customer adds a product to cart then removes it from cart, they will never be able to load the cached version of the page until browser cache expires or they manually dumps browser cache.

    – if they close the browser and reopen the same will happen.

    Ideally, I would rather you did not BYPASS cache at all (even with a product in the cart, since ajax should bust the cache).

    If that is not possible (why?), then maybe you could limit cache BYPASS only to cases where woocommerce_items_in_cart and/or woocommerce_cart_hash are stored => emptying the cart should then result in the cached page being loaded again, even if woocommerce session cookie is present.

    Thank you in advance

    Giacomo

    • This topic was modified 2 months, 3 weeks ago by gbruzzo.
    • This topic was modified 2 months, 3 weeks ago by gbruzzo.
    • This topic was modified 2 months, 3 weeks ago by gbruzzo.

    The page I need help with: [log in to see the link]

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Author Stanimir Stoyanov

    (@sstoqnov)

    SiteGround Representative

    Hey @gbruzzo

    This is expected behavior and we don’t cache pages when the session cookie is present because:
    – If we cache pages, when the cookie exists, we will cache sensitive data, like credit card numbers, personal data, etc, which is a much bigger issue than serving non-cached content.
    – The wp_woocommerce_session_ cookie has a two days expiration, which means that the customers will receive cached content if they visit the site after two days.

    Regards,
    Stanimir

    Thread Starter gbruzzo

    (@gbruzzo)

    Hello @sstoqnov,

    thank you very much for responding to my query.

    Could you please clarify further, as I am not sure what you mean by ‘caching sensitive data’?

    If I am not mistaken, each wp_woocommerce_sessions_ cookie points to an entry in the wp_woocommere_sessions table. This table holds information relating to the cart, product in cart and associated statistics, but certainly no credit card information.

    As far as I understand, payment token data is stored in other tables (wp_woocommerce_payment_tokens, wp_woocommerce_payment_tokenmeta for Stripe etc), irrespective of the wp_woocommerce_sessions.

    I therefore don’t understand what ‘sensitive‘ data could be gleaned from cache that cannot already be gleaned from the site itself. Are these GDPR issues? Please help me understand.

    Not caching when the wp_woocommerce_session_ cookie is present seems like overkill. I could in the limit understand if you did not cache when woocommerce_items_in_cart=1 is present (though even this should be necessary, if you update the cart via ajax).

    I really would like to use your plugin on our e-commerce instead of our previous solution (WP Fastest Cache), but this cache BYPASS is quite problematic for us.
    TTFB of pages goes up from 40-100ms to 1 – 2s depending on the page (Woocommerce pages are in particular affected) when cache is BYPASSED – all benefits are gone.

    Would you please consider making the cookie BYPASS optional?

    If you do not, can you suggest options? I considered shortening the expiry time of the woocommerce session cookie to 10-15 minutes, but not sure it’s a great idea.

    Thank you in advance for any further comments.

    Giacomo Bruzzo

    Plugin Author Hristo Pandjarov

    (@hristo-sg)

    SiteGround Representative

    The cookie is piece of stored information on your browser which the website can access on later stage. The existince of a cookie sessions tells the service that there’s private information that should not be shared with the next visitor.

    No, it is not an overkill. Setting that cookie on every hit without any user action is an overkill and bad coding.

    By default WooCommerce does not work like that. The cookie is set when someone adds to their card and that works great. There must be some plugin you have for WooCommerce that sets it. I would recommend that you reach out to a developer if you need assistance tracking which one it is and modifying it to work properly with our caching system.

    Thread Starter gbruzzo

    (@gbruzzo)

    Hello @hristo-sg

    thank you for your response.

    It was not my intention to upset or criticise you or your team, I am genuinely just trying to understand.

    If you read the first post above, you will see I described a sequence of actions on an installation with only WordPress, Woocommerce and storefront. No other plugins are involved.

    The issue I face is : if a customer adds a product to cart, then removes it, they will have to wait for the Woocommerce session cookie to expire (2 days) to get a new cache HIT. Until then, cache will be bypassed. That seems like a long time to wait, and time is money.

    thanks in any case

    Giacomo Bruzzo

    Plugin Author Stanimir Stoyanov

    (@sstoqnov)

    SiteGround Representative

    Hey @gbruzzo

    Just remove the cookie when the cart has been emptied.

    You can use the woocommerce_remove_cart_item hook and the following code to check if the cart is empty:

    
    if ( WC()->cart->get_cart_contents_count() == 0 ) {
            // Remove the cookie
    }
    

    Regards,
    Stanimir

    Thread Starter gbruzzo

    (@gbruzzo)

    Dear @sstoqnov

    Thank you

    I will try this out.

    I hope you reconsider offering customers the option to serve cached pages when the wp_woocommerce_session cookie is present. (Other providers, such as Kinsta, allow for specific server rules – see: https://kinsta.com/blog/wordpress-cookies-php-sessions/#3-exclude-pages-from-cache-when-the-cookie-is-present).

    This kind of option would be welcome for VPS subscribers such as myself.

    Kind regards,

    Giacomo Bruzzo

    • This reply was modified 2 months, 3 weeks ago by gbruzzo.
    • This reply was modified 2 months, 3 weeks ago by gbruzzo.
    Thread Starter gbruzzo

    (@gbruzzo)

    Dear @sstoqnov

    maybe of interest to others: I have implemented

    
    add_action( 'woocommerce_cart_item_removed', 'after_remove_product_from_cart', 10, 2 );
    function after_remove_product_from_cart() {
      if ( WC()->cart->get_cart_contents_count() == 0 ) {
            		WC()->session->destroy_session();
    	}
    
    }
    

    as per your suggestions (only changed the hook to run just after the item has been removed). I will test further to see if removing a the session cookie when emptying the cart causes issues elsewhere.

    At the risk of sounding like Don Quixote, I would prefer to be able to change the caching behaviour at the server level, rather than change default Woocommerce session behaviour to achieve better caching.

    In any case, thank you all very much for the support

    Giacomo Bruzzo

    Plugin Author Stoyan Georgiev

    (@stoyangeorgiev)

    Marking as resolved.

Viewing 8 replies - 1 through 8 (of 8 total)
  • You must be logged in to reply to this topic.