: E-commerce with secure cart and payment I want to create an e-commerce project online.. so I have this issue : if the user is not logged in , then the selected products will be automatically

@Marchetta884

I recommend storing all state, including the state of the cart, in session state on the server side. It doesn't need to be in the database; most web application frameworks provide a way to store session state on the server side, e.g., in memory. I don't recommend storing this state in cookies. The reason is that a malicious client can tamper with data stored in the cookies. (For instance, if you stored the set of items in the cart and their prices in cookies, then a malicious user could modify the price of each item as found in his/her cookie.) Because session state is linked to the session, not the user, session state is automatically preserved if the user creates an account in the middle of their session.

Vote Up Vote Down

@Rambettina238

Well, I think this is more of a StackOverflow question than a Security one. That said, I wouldn't perform any updates on the database until you get to the order submission stage. There's no reason to track what's in a cart except by session data. Whether you want to maintain the state on the server or just pile on cookie entries is a question that I think is just an architectural triviality.

I imagine you're in a position where a user must create an account to place an order. If that's the case, you should be all set. A cart isn't connected to a customer until it becomes an order or the customer logs in and the cart is persisted to it survives across sessions. If a customer can place an order without an account, attach it to a single default user.

Vote Up Vote Down