CustomerID jumps from 1 to 591 for only 8 registred users

The only thing that *could* be considered a potential problem are the bots that aren't detected as bot and that don't use cookies, which cause them to create a new customer on each request. I think this could be fixed by creating a GuestCustomer class that uses the guest customer cookie to store its attributes, language, everything that's usually stored in the database and to actually create a real customer entry (still unregistered) only when stuff is actually put in the shopping cart.

In this case, the add to cart should probably be modified to only support POST or use some form of automatic human validation (but that usually require javascript to be activated) in order to limit the number of unregistered bots that could add to the shopping cart.

Those are only ideas, let me know what you think, if you think its worth it or not.

Spiders don't accept cookies

The Actions that AddToCart are already marked as HttpPost.

AndyMcKenna wrote:

My version still had the one in ShoppingCartController not marked as HttpPost but it is in the nop repository. Good point.

I had to try it... I finally did yesterday evening. I modified my clone of nop to support "volatile" guest customers, that is that are not stored in the database. The strategy I used to limit the changes to the code is that as long as a user doesn't interact with the site (add customer content, add to cart - as long as I don't need a customer id), no guest is ever created in the database. Instead, its attributes and properties are stored in the session. When a database-customer is required, one is automatically created, this is transparent to the user. All reference-type attributes are json-serialized in a custom service and stored in the session. The call to IsSearchEngine while getting the current customer is no longer necessary. Don't know if I overlooked something, but so far it seems to be working fine. I'm not running this in a live site but might in a near future.

Just thought I'd write it here in case it interests someone :)

asoares wrote:
I would be great if you could share your changes

it's ok that non-cookie client connections are tracked as guests ... but why do a high proportion of those 'guests' get tagged as the local IP address not the originating client IP ?

AndyMcKenna wrote:

Can I remove this functionallity in 2.4 as I have an Insert trigger into a Stock Mangement System that is inserting/updating registered customers and everytime an unregistered guest browser's its inserting into there stock mangement System. Which they don't won't can we disable it.

All help alway's highly regarded

Richard

Can you modify your trigger to check if the user is in the Guest role?

AndyMcKenna wrote:

Yes an If statement on the Email or the user Name if null. Right.. Also please what Classes / Objects generate the guest roles. I need to know. :)

Thank You Andy

Richard