shopping cart items disappear NC 4.2

Have the strangest problem regarding some orders (now up to 9 out of 100 or so) whereby the shopping cart items disappear from the order.  Totals, customer info, etc, is all there, only the shopping cart items are not - so I ruled out a cookie-cutter problem (at least I think so).
Anyway - just stumped as to why this is happening and have tried everything to reproduce the problem (6 browsers on Win7-10, iMac, Android, Safari on iPhone, PCs, Macs) and cannot figure out what is going on.
  I didn't want to report it as a bug yet, but, so far it's costing sales - when people see no products after checkout, they bail or cancel the order.
Anyone else have this issue?  Any ideas on where to look? (there are no errors logged!)

beefydog wrote:
Maybe this?
Since that is just from time to time, and there is no rule, not much we may help...

Regards,
Tom

This is coinciding with duplicate orders (this happens only on duplicate orders from what I can see).
What I think is going on:
User clicks button to Place Order, cart is delaying way too long, so they impatiently click the button again.  However, the cart is emptied because the session is cleared by the cart, so no items show up.  
Just a guess, but since checkout code was never altered, it's a problem with NC4.2 or maybe a browser plug in (Paypal has always had this problem with impatient people or PayPal being down forcing people to attempt to checkout again).
It's also appears to coincide with Chinese bot attacks (about 20-30 inside of 5 minutes slows the site to a crawl - which is odd as it's a single website running on a dual 16core CPU 3.2Ghz processor w/32GB of RAM and SSDs - it should handle thousands of requests!)
Anyway, it's about 1 out of 5 orders as of today and driving me crazy.
I'll keep hacking along trying to reproduce this situation.

It could be that you need a machine key or http/s issue.  See this similar topic
https://www.nopcommerce.com/en/boards/topic/51262/upgraded-from-40-and-cant-see-items-in-cart

I saw that link.  It has been set to require SSL and require www. prefix  and I've had the machine key setup.  Something else is going on.

I did find in the IIS server logs the following 2 identical entries, 7 seconds apart (the double posting), and can't figure out how this is possible (I ran as many scenarios as I could myself from different browsers and can't reproduce the problem).  
It posted twice! How is this even possible?

2020-09-22 19:59:14 W3SVC5 EJEWEB2 192.168.2.140 POST /checkout/OpcConfirmOrder/ - 443 - 68.54.253.214 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:80.0)+Gecko/20100101+Firefox/80.0 _gcl_aw=GCL.1600455349.Cj0KCQjwtZH7BRDzARIsAGjbK2b_7pr1Vel2_ISb5qe-VKhOt6dE4cBGuk7NY5qoz73LNpLmE96XXrUaAvedEALw_wcB;+_gcl_au=1.1.1950563251.1599674204;+_ga=GA1.2.1495224160.1599674206;+_gac_UA-4027232-1=1.1600455350.Cj0KCQjwtZH7BRDzARIsAGjbK2b_7pr1Vel2_ISb5qe-VKhOt6dE4cBGuk7NY5qoz73LNpLmE96XXrUaAvedEALw_wcB;+__atuvc=31%7C37%2C12%7C38%2C3%7C39;+ypos=714;+.Nop.Antiforgery=CfDJ8KQIj5MGaFREmYOyxUpEyMU5I4p4tQmNZ2srgRjx6sIj9PlBglLyXv7ZjA1KNPDYAgMEbFV-JlorNhS2VByg9pByYkBfugIvvRhTIUn4OVgIinADYJmTbWOFOXAJGYS_NzmlCjNS5bB09QW4kdITFNs;+.Nop.Session=CfDJ8KQIj5MGaFREmYOyxUpEyMVmzO%2Bvc7KEwx7zPvVbMlUAroO42UBEmKwTgTvlQETK5AdgOPT7KGnGNOwQ7zHrLTddK%2BJ6rermb1VGq1pncja%2F9SCPcFm%2BRLbJdWINng1Kw56O44Yyf0xhDDrvbE7VjdGlQ6BKv3y6bWnngGw%2Br9XA;+.Nop.Authentication=CfDJ8KQIj5MGaFREmYOyxUpEyMWZS8FpeWgjiidSypZkvrXXV3QGijYY3pS4RaZ...


2020-09-22 19:59:27 W3SVC5 EJEWEB2 192.168.2.140 POST /checkout/OpcConfirmOrder/ - 443 - 68.54.253.214 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:80.0)+Gecko/20100101+Firefox/80.0 _gcl_aw=GCL.1600455349.Cj0KCQjwtZH7BRDzARIsAGjbK2b_7pr1Vel2_ISb5qe-VKhOt6dE4cBGuk7NY5qoz73LNpLmE96XXrUaAvedEALw_wcB;+_gcl_au=1.1.1950563251.1599674204;+_ga=GA1.2.1495224160.1599674206;+_gac_UA-4027232-1=1.1600455350.Cj0KCQjwtZH7BRDzARIsAGjbK2b_7pr1Vel2_ISb5qe-VKhOt6dE4cBGuk7NY5qoz73LNpLmE96XXrUaAvedEALw_wcB;+__atuvc=31%7C37%2C12%7C38%2C3%7C39;+ypos=719;+.Nop.Antiforgery=CfDJ8KQIj5MGaFREmYOyxUpEyMU5I4p4tQmNZ2srgRjx6sIj9PlBglLyXv7ZjA1KNPDYAgMEbFV-JlorNhS2VByg9pByYkBfugIvvRhTIUn4OVgIinADYJmTbWOFOXAJGYS_NzmlCjNS5bB09QW4kdITFNs;+.Nop.Session=CfDJ8KQIj5MGaFREmYOyxUpEyMVmzO%2Bvc7KEwx7zPvVbMlUAroO42UBEmKwTgTvlQETK5AdgOPT7KGnGNOwQ7zHrLTddK%2BJ6rermb1VGq1pncja%2F9SCPcFm%2BRLbJdWINng1Kw56O44Yyf0xhDDrvbE7VjdGlQ6BKv3y6bWnngGw%2Br9XA;+.Nop.Authentication=CfDJ8KQIj5MGaFREmYOyxUpEyMWZS8FpeWgjiidSypZkvrXXV3QGijYY3pS4RaZ...

I'm using the one-page checkout in my theme. Maybe there's a bug in the javascript.