?sid in URL even if disabled

[gewaechshaus]

Hey,

we are running a composer based 2.1.0 install with haproxy and varnish in front of nginx and noticed that the sid variable appears in the URL even if it's disabled in backend.

[plentyhappy]

We have the same problem on 2.0.7. Had this problem since 2.0. Just asked my hosting company for help. They were able to fix on their end and said this:

SID issue should be resolved now. If you clear your browser cache (or use private/incognito browsing) going to xxxxxxx.com should redirect to www.xxxxxxx.com without any SID. We added a 301 redirect to the pub/.htaccess file:

RewriteCond %{HTTP_HOST} ^xxxxxxx.com
RewriteRule ^(.*) http://www.xxxxxxx.com/$1 [L,R=301]

[sevos1984]

We will close this issue as not updated more than 2 weeks if this issue still reproducible please feel free to create the new one.

[Will-I4M]

It seems to be back in 2.1.2 !
I disabled the use of SID in admin but :

Résolution de www.xxxxxxx.com (www.xxxxxxxx.com)… xx.xx.xx.xx
Connexion à www.xxxxxxxx.com (www.xxxxxxxx.com)|xx.xx.xx.xx|:80… connecté.
requête HTTP transmise, en attente de la réponse… 301 Moved Permanently
Emplacement : http://xxxxxxxx.com/?SID=ggjarfb9f28190a51b0nossoh2 [suivant]

I use 301 in admin.

[gewaechshaus]

Damn, I'm going to recheck it asap...

[Will-I4M]

Thanks, just a thing, i've edited my message to remove ip on the github website, but as you answered using mail, the ip is back in your response, could you edit and remove the ip in it ?
Thanks a lot !

[serzhik]

Same issue in 2.1

[ctadlock]

I still see this issue in Magento 2.1.3.

[nigelcopley]

i´m seeing it in 2.,1.2

[valibus]

Same problem in 2.1.0 using this architecture:
Apache -> <-varnish -> <-niginx -> internet
Any helps or patch ?

[jaywilliams]

Here's a .htaccess workaround, which you can modify for your particular use case:

############################################
## Site Redirects
<IfModule mod_rewrite.c>
    RewriteEngine on
    ############################################
    ## Require "www." prefix for all sites
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    ############################################
    ## Require HTTPS for all sites
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP_HOST} ^www\. [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

[hggeorgiev]

Keep in mind that the workaround won't work if your store base URL doesn't start with www i.e it shouldn't be wildcard. Change it from https://yoursitename.com to https://www.yoursitename.com from the store config options before putting this in your .htaccess file, otherwise you will get redirection errors.

[hostep]

We als see this happening using Magento CE 2.1.4

@maksek: I believe this issue should be reopened?

In case it is needed, I added a very easy case of how you can reproduce this:

Preconditions

• Magento CE 2.1.5
• PHP 7.0.16
• Apache 2.2.32

Steps to reproduce

1. Install Magento CE 2.1.5 using composer
2. During the installation, set the base url to: https://www.m2.dev/
3. In your Apache configuration, set up a VirtualHost with 2 domains, one with 'www' and the other without 'www', something like this:

<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile "/opt/local/apache2/conf/server.crt"
    SSLCertificateKeyFile "/opt/local/apache2/conf/server.key"

    ServerName m2.dev
    ServerAlias www.m2.dev

    DocumentRoot "/path/to/magento2/pub"
    
    <Directory "/path/to/magento2/pub">
      Options Indexes FollowSymLinks ExecCGI
      AllowOverride All
      Order allow,deny
      Allow from all
    </Directory>
</VirtualHost>

4. After the installation, do this:

$ curl -I --insecure https://www.m2.dev/
HTTP/1.1 200 OK
# good, is expected!

$ curl -I --insecure https://m2.dev/
HTTP/1.1 302 Found
Location: https://www.m2.dev/?SID=abcdef...
# good, is expected!

5. Now change the Magento setting: General => Web => Session Validation Settings => Use SID on Storefront => No
6. Flush your caches
7. Execute the same thing as above:

$ curl -I --insecure https://www.m2.dev/
HTTP/1.1 200 OK
# good, is expected!

$ curl -I --insecure https://m2.dev/
HTTP/1.1 302 Found
Location: https://www.m2.dev/?SID=abcdef...
# NOT good, there should be NO ?SID in the url!