Difficulty: Easy

Modification: Store Configuration

Q:

I keep getting complaints from potential customers that they are unable to use magento’s checkout. Instead of going to checkout they are logged out of the system and their cart is emptied. Why is this happening? What can I do about that?

A:

The issue in this case is that magento validates user sessions using their IP addresses. Validating customer’s IP address fails miserably when the customer’s ISP uses a proxy for http connections (and it seems many ISPs do that, at least in the UK). The problem occurs when switching from http to https. When on http, the customer connects through a proxy, so the session is created with the proxy’s IP address. When the customer is redirected to https (eg. goes to checkout) the connection is direct and the proxy is bypassed. Now the customer is connecting from his own IP address and not through a proxy, so his IP has changed. Magento detects this and invalidates the session.

The fix is fairly simple. You have to change the Session Validation settings in the Magento Admin. To do that go to System > Configurations > Web and choose ‘no’ on every option. After doing this,  go to System > Cache Management and refresh the configuration cache to apply the changes.

Difficulty: Easy

Modification: Config files, Database

Q:

Ok so I went to SYSTEM | ADVANCE and changed the path to log into the admin panel to another name.

Now, I can’t log in to the admin panel.

A:

First of all you would need to undo what you did – unset the custom admin url in the database. To do this, you would need to interact with the database. My preference is to use phpmyadmin, but you might also do it with the command line interface. Go to the table ‘core_config_data’ and delete the rows:

• admin/url/use_custom
• admin/url/custom

After that you need to properly set your custom admin url in the config file /app/etc/local.xml. In this file change this:

<frontName><![CDATA[admin]]></frontName>

to this:

<frontName><![CDATA[your_custom_admin_url]]></frontName>

Now save the file and clear the cache (if you are using it). If you still don’t have access to the admin you may clear the cache by deleting the contentss of the /var/cache directory.

On thing to remember is that while hiding your admin url makes your site more secure, it is not the ultimate solution for all your security issues. If your magento version is lower than 1.4, your admin url is easily discoverable by anyone unless you do some additional tweaking.