Smith Cart 2.96. Sequence:

1. At DNN site, register as a new site user: JoeBlow.
2. Buy something.
3. Smith_Customer table shows a new row, CustomerID = 9, name and address information is all fine.
4. Logout of DNN site.
5. Register as a new site user: SallySwift.
6. Buy something
7. Smith_Customer table does NOT show a new row.
8. Smtih_StoreOrders table shows a new row for Sally's purchase -- but it uses CustomerID = 9, which is Joe Blow's! :-( The ShipFirstName, ShipLastName, etc. fields all have Sally Swift's information in them, but the CustomerID is 9.
9. Logout of DNN site.
10. Close all browser windows.
11. Restart browser, go to site, login as Sally Swift. Buy something.
12. Smith_Customers table gets a new row, CustomerID = 10. Smith_StoreOrders gets a new row, with CustomerID = 10. Just fine.

It looks like the CustomerID is stored as part of the application's session state. It's as if the cart logic goes like this:

• Does the session state have a value for CustomerID?
• If yes, use that CustomerID no matter who the logged-in user is.
• If not, look up a row in Smith_Customers with a DNNLogin value equal to the current logged in user's DNN UserName.
• If found, use that CustomerID. If not, create a new CustomerID. Either way, store the CustomerID in session state.

This wouldn't be a problem except for computers that get used by multiple people -- e.g. a walk-up computer in a training room or meeting room at a business. If somebody buys something, then logs out of the DNN site, but does NOT close the browser, and then someone else comes up and logs into the DNN site, the cart will use the previous person's CustomerID.

Looks like a bug.

Try using a different browser instead of logging in and out (FF, Chrome, or IE), or clear your cookies when you log out. The cart is connected to a cookie/session not the actual logged in user which is the way some of the big ecommerce site works like walmart, target, home depot, etc. I don't think there are many customers that will be logging in as 2 different users. In any event our programming team is looking into this to evaluate the if its feasible to remove the cookie/session.

-Scott

---

Scott Kelly
Project Manager