Recently, we've seen many of our clients get an error that nopCommerce cannot get the authenticated user on application startup in nopCommerce 4.20. We've figured out that happens only when there are plugins to be installed.
After a bit of debugging this is what we've found out:
When the application starts up the InstallPlugins() method in the PluginService is called. There is a try-catch on line 416 in the PluginService. If any exception is raised inside the try block a message will be logged in the catch clause. On line 439, in order to build the log message for the error, the code tries to get the "Admin.Plugins.Errors.NotInstalled". In order to get the resource, the code needs to get the Working Language which needs the Current Customer. When nopCommerce tries to get the current customer an exception occurs when nopCommerce tries to get the currently authenticated user and that exception is logged. That causes the initial exception to not be logged anywhere - neither in the system log nor in the stdlog.
Furthermore, even if no error is raised in the try block, when the execution of the code gets to line 429 it raises the same error as the code tries to get the "ActivityLog.InstallNewPlugin" resource in order to log the customer activity (installed plugin).
The issue comes from the fact that nopCommerce cannot get the authenticated user. The issue only occurs on stores where the customer with SystemName "BackgroundTask" is missing.
In the CurrentCustomer property in the WebWorkContext on line 193 there is an if clause where it is checked whether the http context is null :
if (_httpContextAccessor.HttpContext == null || _httpContextAccessor.HttpContext.Request.Path.Equals(new PathString($"/{NopTaskDefaults.ScheduleTaskPath}"), StringComparison.InvariantCultureIgnoreCase))
{
//in this case return built-in customer record for background task
customer = _customerService.GetCustomerBySystemName(NopCustomerDefaults.BackgroundTaskCustomerName);
}
However, if the store doesn't have such user in the database the customer returned from the GetCustomerBySystemName method is null which eventually will lead the code to go into the if clause on line 207:
if (customer == null || customer.Deleted || !customer.Active || customer.RequireReLogin)
{
//try to get registered user
customer = _authenticationService.GetAuthenticatedCustomer();
}
Since the customer variable is null the code will call the GetAuthenticatedCustomer method.
As you can see on line 101 in the CookieAuthenticationService the GetAuthenticatedCustomer method will try to call the AuthenticateAsync method of the http context but since the http context is null it will cause an exception:
var authenticateResult = _httpContextAccessor.HttpContext.AuthenticateAsync(NopAuthenticationDefaults.AuthenticationScheme).Result;
Although this issue only happens when your database lacks the customer with system name "BackgroundTask" and we are not really sure why would any database miss that customer, we've seen many customers with this issue in the past month. Just this week we had 5 with the exact same error. All of them had different exceptions occur during the installation of their plugins, but finding out what the real cause of the issue was a real challenge due to the fact that the error couldn't be logged.
I think the issue would be solved if there is a check for whether the http context is null on line 101 inside the CookieAuthenticationService.
As for the store owners that have this issue in 4.20 - you can resolve this issue by creating a user with system name "BackgroundTask".
Regards,
Anton
