{"action":"opened","issue":{"url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/1052","labels_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/1052/labels{/name}","comments_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/1052/comments","events_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/1052/events","html_url":"https://github.com/nexcess/magento-turpentine/issues/1052","id":122321132,"number":1052,"title":"A crawler gets a valid session value if switching from secured to unsecured pages","user":{"login":"ADDISON74","id":8360474,"avatar_url":"https://avatars.githubusercontent.com/u/8360474?v=3","gravatar_id":"","url":"https://api.github.com/users/ADDISON74","html_url":"https://github.com/ADDISON74","followers_url":"https://api.github.com/users/ADDISON74/followers","following_url":"https://api.github.com/users/ADDISON74/following{/other_user}","gists_url":"https://api.github.com/users/ADDISON74/gists{/gist_id}","starred_url":"https://api.github.com/users/ADDISON74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ADDISON74/subscriptions","organizations_url":"https://api.github.com/users/ADDISON74/orgs","repos_url":"https://api.github.com/users/ADDISON74/repos","events_url":"https://api.github.com/users/ADDISON74/events{/privacy}","received_events_url":"https://api.github.com/users/ADDISON74/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-15T17:14:01Z","updated_at":"2015-12-15T17:14:01Z","closed_at":null,"body":"Here is my server configuration in a VM test machine (Debian 7.9 x64, Magento CE 1.9.2.2 + Default sample pack, Turpentine the latest devel version):\r\n\r\nPound (IP: 192.168.159.102, Ports: 80 and 443 SSL-Offloading) =>\r\nVarnish (IP: 192.168.159.102, Port: 8090) =>\r\nApache (IP: 192.168.159.102, Port 8080)\r\n\r\nI am not using full secured frontend, just only for My Account, Checkout pages. Here is my configuration in backend (please note there are no other changes except in disabling Magento default cache in Cache Management and basic Turpentine options):\r\n\r\n- System -> Configuration -> Web -> Unsecure -> Base URL = <strong>http</strong>://www.mydomain.com/\r\n- System -> Configuration -> Web -> Secure -> Base URL = <strong>https</strong>://www.mydomain.com/\r\n- System -> Configuration -> Web -> Use Secure URLs in Frontend = Yes\r\n\r\n(see difference between unsecure/secure values).\r\n\r\nLet's set up in Turpentine Crawler IP value to 192.168.159.102 in order to consider this IP address a crawler and bypassing cookies for all visitors.\r\n\r\n![crawler_ip](https://cloud.githubusercontent.com/assets/8360474/11816757/99f3970a-a35a-11e5-8380-7526d7db3a92.jpg)\r\n\r\nHere is first time visiting the Home Page (all cookies and browser cache cleared before). There are no cookies after loading the page. It is a crawler-session. In this image you don't see crawler_session cookie because I cleared this cookie after visiting the page.\r\n\r\n![home_page](https://cloud.githubusercontent.com/assets/8360474/11816997/9f4ef770-a35b-11e5-94a0-188e11bfbedb.jpg)\r\n\r\nNext we visit any category, in my case Accessories. Also there are no cookies after loading this page.\r\n\r\n![category_accessories](https://cloud.githubusercontent.com/assets/8360474/11817005/a45ebf70-a35b-11e5-90a2-30b119c6d3be.jpg)\r\n\r\nNow let's visit \"My Account\" which is a secured page. Now we get 3 cookies: adminhtml, frontend, frontend_cid. Look how frontend cookie gets an alphanumeric value, changing it from crawler_session.\r\n\r\n![secured_link](https://cloud.githubusercontent.com/assets/8360474/11817062/e559c236-a35b-11e5-8047-e85edb745eb4.jpg)\r\n\r\nLet's go back to a previously visited category, click on Accessories link. This page is unsecured. 2 cookies were deleted: adminhtml and frontend_cid. We still have frontend cookie with an alphanumeric value, not \"crawler_session\" and this is a big issue. From now on any page visit of this crawler it is considered a usual visitor. \r\n\r\n![category_accesories_after](https://cloud.githubusercontent.com/assets/8360474/11817267/de5148dc-a35c-11e5-8076-d5f0c238c1a4.jpg)\r\n\r\n<strong>In conclusion</strong>: You should change your code for this scenario to avoid cookie creation/change in secured pages if it is a \"crawler_session\". Switching from secured to unsecured pages should not change initial value of frontend cookie!."}}