Do not cache checkout link so it can be used more than once

Created on 20 December 2024, 10 months ago

Problem/Motivation

When the config option 'use_changed_timestamp' is set to zero, the checkout link's hash remains valid even after the Commerce order changed. So I assumed that this meant that the link could be used more than once.

In theory, this is true. But when the link is used by a not logged in user (with no active session) a second time, that user gets access denied. That is because the redirect to checkout gets cached. After I clear caches, the link can be used again.

Use case: for Commerce Abandoned Carts I'm working on an integration with this module. See Link to the cart in the email could be non-session dependent Needs review .
When a customer does not complete their order, they get a mail after some time with a link to their cart. Integration with this module means they can continue checkout even if they no longer have an active session on the site. But for a client site, some customers complained about the link no longer being valid when they tried to use it a second time.

Steps to reproduce

  • As an anonymous user, put a product in the cart.
  • Go to checkout.
  • Do not complete checkout.
  • Destroy the session or open the site in an other browser.
  • Generate a checkout link and use it.
  • Again, do not complete checkout.
  • Again, destroy the session or open the site in an other browser.
  • Use the same checkout link as earlier.

A redirect to /checkout/x/x happens, but the user gets access denied.

Proposed resolution

Do not cache the route 'commerce_checkout_link.checkout_link'.

Remaining tasks

User interface changes

API changes

Data model changes

Feature request
Status

Active

Version

1.0

Component

Code

Created by

🇳🇱Netherlands megachriz

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @megachriz
  • Merge request !10Resolve #3495252 "Checkout link no cache" → (Open) created by megachriz
  • Pipeline finished with Failed
    10 months ago
    Total: 211s
    #374855
  • Pipeline finished with Canceled
    10 months ago
    Total: 74s
    #374890
  • 🇳🇱Netherlands megachriz

    In the MR I provided a fix and tests. Some code for the tests are copied from the Commerce Abandoned Cart tests. I did try to programmatically created order by reusing code from RedirectTest, but I ran into the issue that the path /cart did not exist, probably related to the code that fakes a request.

    I hope that the tests pass. I just noticed that there might be a random test failure happening.

  • 🇳🇱Netherlands megachriz

    I see that RedirectTest is failing, that's unrelated to this issue, but it's caused by that the signature of createUser() has changed in Drupal. It now expects a list of permissions as first parameter.

  • 🇳🇱Netherlands megachriz

    The tests look like they need work. I get indeed a random test failure.

  • Pipeline finished with Failed
    10 months ago
    Total: 619s
    #374891
  • Issue was unassigned.
  • Status changed to Needs work 8 months ago
  • 🇮🇳India pemson18 South Goa
  • 🇮🇳India pemson18 South Goa
  • 🇮🇳India pemson18 South Goa
  • 🇮🇳India pemson18 South Goa
  • 🇮🇳India pemson18 South Goa

    The `use_changed_timestamp` configuration setting should be moved to a configuration form, making it part of the module's settings. For checkout links, it is recommended that this configuration be global and not be overridden when calling the following method:

    CheckoutLinkManager::generateUrl($order);

    Additionally, the method:
    public static function generateHash($timestamp, OrderInterface $commerce_order);

    should be refactored to accept only two parameters. The value of `use_changed_timestamp` should then be retrieved from the module's configuration settings, rather than being passed as a parameter in the method call.

    This approach ensures better consistency and flexibility by centralizing the configuration while simplifying the method signature.

Production build 0.71.5 2024