I am using an ecommerce website. When I log in, I would expect my cart to be empty. But it shows the cart items selected by another user who previously used the same machine and logged out. Is this a security issue?

  • Looks the shopping cart is stored in a browser cookie and logging off does not delete it. Unless there is extra info on the cookie it would not insecure per se but just a leak of information. You shouldnt know what others buy.
    – bradbury9
    Mar 16, 2019 at 20:07

1 Answer 1


In short, yes.

That is not a well designed website and I'd stay clear, certainly don't put any of your payment details into it!

With regards to your question, it's a little vague so I want to expand on it to ensure I clear all ground.

If you're speaking specifically on what could happen if user1 could see user2's basket (nothing else)? Then the only security concern is user1 knowing what user2 has in their basket. From a certain perspective, it's harmless, however, usually after a basket comes check out, and if user2 entered more private information, we can only assume this data is there still also!

On the above assumption, it would seem if you were just logging in, and seeing someone else's basket, that website doesn't support sessions (why oh why!?). So, other than a terribly built website, in the context in which you speak, nothing else could be done.

If this website did store sessions, you wouldn't quite be able to just log in and view another users basket, however, let's assume for this question that we can do that, then yes, it's a huge security issue.

Session's are something created and act as a global variable on a server, the session has a unique identifier to you, and nobody else. A session is identified through a token, which is delivered to the browser as a cookie.

They are used for a variety of purposes, simply transferring information from one page to another or storing items in a shopping cart for a specific user requires a session.

Hijacking this session, simply put, essentially makes you the owner of that account.

Session Hijacking is a thing, and a terribly effective attack on vulnerable websites, see here to see why.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .