Woocommerce session cookie causes Cache BYPASS

Hey @gbruzzo

This is expected behavior and we don’t cache pages when the session cookie is present because:
– If we cache pages, when the cookie exists, we will cache sensitive data, like credit card numbers, personal data, etc, which is a much bigger issue than serving non-cached content.
– The wp_woocommerce_session_ cookie has a two days expiration, which means that the customers will receive cached content if they visit the site after two days.

Regards,
Stanimir

Hello @sstoqnov,

thank you very much for responding to my query.

Could you please clarify further, as I am not sure what you mean by ‘caching sensitive data’?

If I am not mistaken, each wp_woocommerce_sessions_ cookie points to an entry in the wp_woocommere_sessions table. This table holds information relating to the cart, product in cart and associated statistics, but certainly no credit card information.

As far as I understand, payment token data is stored in other tables (wp_woocommerce_payment_tokens, wp_woocommerce_payment_tokenmeta for Stripe etc), irrespective of the wp_woocommerce_sessions.

I therefore don’t understand what ‘sensitive‘ data could be gleaned from cache that cannot already be gleaned from the site itself. Are these GDPR issues? Please help me understand.

Not caching when the wp_woocommerce_session_ cookie is present seems like overkill. I could in the limit understand if you did not cache when woocommerce_items_in_cart=1 is present (though even this should be necessary, if you update the cart via ajax).

I really would like to use your plugin on our e-commerce instead of our previous solution (WP Fastest Cache), but this cache BYPASS is quite problematic for us.
TTFB of pages goes up from 40-100ms to 1 – 2s depending on the page (Woocommerce pages are in particular affected) when cache is BYPASSED – all benefits are gone.

Would you please consider making the cookie BYPASS optional?

If you do not, can you suggest options? I considered shortening the expiry time of the woocommerce session cookie to 10-15 minutes, but not sure it’s a great idea.

Thank you in advance for any further comments.

Giacomo Bruzzo

The cookie is piece of stored information on your browser which the website can access on later stage. The existince of a cookie sessions tells the service that there’s private information that should not be shared with the next visitor.

No, it is not an overkill. Setting that cookie on every hit without any user action is an overkill and bad coding.

By default WooCommerce does not work like that. The cookie is set when someone adds to their card and that works great. There must be some plugin you have for WooCommerce that sets it. I would recommend that you reach out to a developer if you need assistance tracking which one it is and modifying it to work properly with our caching system.

Hello @hristo-sg

thank you for your response.

It was not my intention to upset or criticise you or your team, I am genuinely just trying to understand.

If you read the first post above, you will see I described a sequence of actions on an installation with only WordPress, Woocommerce and storefront. No other plugins are involved.

The issue I face is : if a customer adds a product to cart, then removes it, they will have to wait for the Woocommerce session cookie to expire (2 days) to get a new cache HIT. Until then, cache will be bypassed. That seems like a long time to wait, and time is money.

thanks in any case

Giacomo Bruzzo

Hey @gbruzzo

Just remove the cookie when the cart has been emptied.

You can use the woocommerce_remove_cart_item hook and the following code to check if the cart is empty:

if ( WC()->cart->get_cart_contents_count() == 0 ) {
        // Remove the cookie
}

Regards,
Stanimir

Dear @sstoqnov

Thank you

I will try this out.

I hope you reconsider offering customers the option to serve cached pages when the wp_woocommerce_session cookie is present. (Other providers, such as Kinsta, allow for specific server rules – see: https://kinsta.com/blog/wordpress-cookies-php-sessions/#3-exclude-pages-from-cache-when-the-cookie-is-present).

This kind of option would be welcome for VPS subscribers such as myself.

Kind regards,

Giacomo Bruzzo

• This reply was modified 3 years, 8 months ago by gbruzzo.
• This reply was modified 3 years, 8 months ago by gbruzzo.

Dear @sstoqnov

maybe of interest to others: I have implemented

add_action( 'woocommerce_cart_item_removed', 'after_remove_product_from_cart', 10, 2 );
function after_remove_product_from_cart() {
  if ( WC()->cart->get_cart_contents_count() == 0 ) {
        		WC()->session->destroy_session();
	}

}

as per your suggestions (only changed the hook to run just after the item has been removed). I will test further to see if removing a the session cookie when emptying the cart causes issues elsewhere.

At the risk of sounding like Don Quixote, I would prefer to be able to change the caching behaviour at the server level, rather than change default Woocommerce session behaviour to achieve better caching.

In any case, thank you all very much for the support

Giacomo Bruzzo

Marking as resolved.