List additional cart items in ecommerce website

Question

I am using an ecommerce website. When I log in, I would expect my cart to be empty. But it shows the cart items selected by another user who previously used the same machine and logged out. Is this a security issue?

Answer 1

In short, yes.

That is not a well designed website and I'd stay clear, certainly don't put any of your payment details into it!

With regards to your question, it's a little vague so I want to expand on it to ensure I clear all ground.

If you're speaking specifically on what could happen if user1 could see user2's basket (nothing else)? Then the only security concern is user1 knowing what user2 has in their basket. From a certain perspective, it's harmless, however, usually after a basket comes check out, and if user2 entered more private information, we can only assume this data is there still also!

On the above assumption, it would seem if you were just logging in, and seeing someone else's basket, that website doesn't support sessions (why oh why!?). So, other than a terribly built website, in the context in which you speak, nothing else could be done.

If this website did store sessions, you wouldn't quite be able to just log in and view another users basket, however, let's assume for this question that we can do that, then yes, it's a huge security issue.

Session's are something created and act as a global variable on a server, the session has a unique identifier to you, and nobody else. A session is identified through a token, which is delivered to the browser as a cookie.

They are used for a variety of purposes, simply transferring information from one page to another or storing items in a shopping cart for a specific user requires a session.

Hijacking this session, simply put, essentially makes you the owner of that account.

Session Hijacking is a thing, and a terribly effective attack on vulnerable websites, see here to see why.