Hi Rusty,

The error does go away if I delete my cookies, but this isn't really a sustainable solution as the error just seems to come back a few hours later.

I don't actually have a machineKey setting in the web.config and never have done - is it needed? And if so what do I need to do to add one?

Thanks :)

You should not need a machine key in the web.config unless you are doing some sort of load balanced setup.

I've seen this pop up before (rarely) but it's typically when I have a ton of windows open and am doing lots of compiles - then go back and hit an old window.

I've never seen it "periodically recur".

Hmm that is odd..

The error just keeps re-appearing on my machine and several others, including my phone and also my client's.

It's frustrating to say the least! I cannot figure out what is triggering it either - I rarely have multiple windows open and it's not like it occurs after I've made a change or anything like that.

Hi Milly,

Can you try adding a machine key to your web.config and see if that makes a difference. Note (you will need to clear the cookie immediately after the site comes back up with the update do to a change in the encryption seed value change). I'm still having trouble reproducing this consistently on my end but it may be that your web server is recycling the application pool and resetting the machine key (based on an article I read a couple of days ago).

If this alteration does change things for you, I would appreciate you letting me know so I can look into refactoring things a bit to fix things up.

It would be also helpful to know what version of Merchello you have installed. One of the possible culprits is a change made in 2.3.1 http://issues.merchello.com/youtrack/issue/M-1070

Unfortunately, adding a machine key doesn't seem to make a difference :(.

I also tried setting the AnonymousCustomerCookieExpiresDays to 0 - no luck either.

I am using Umbraco 7.5.6, FastTrack 2.3.2 and Merchello 2.3.2.

Thanks

Does adding the machine key fix that issue?

No (already had one before updating).

Joel, are you getting this on a payment provider or randomly navigating?

Rusty, thank you for responding. I rolled back the solution, as I didn't have time to deal with it at this point.

Sorry for the trouble!

Thanks Tom - that explains a lot and makes total sense, especially when considering sites where multiple cookies might be used and that it really only started to become a prevalent issue with the optional change from a session cookie to a persisted cookie.

It's interesting that it increments when you hit the basket - I can't think of anything that might be causing that - unless the recent products listing is not cleaning itself up correctly.

I've added an issue here http://issues.merchello.com/youtrack/issue/M-1264 and am nearly done refactoring how the customer context data is persisted.

Hello,

I have encountered this issue too and can see that that when the "merchello" cookie reaches a certain size, I get YSOD.

I have consolidated my checkout process into a single page, which when requested, will set the Billing and Shipping address in code, as well as the Shipping method and Payment method. I do not require the user to specify any of these, as I already have that pre-determined. So, I am just setting those myself within code.

I am then preparing an invoice, so that I can pass that data to my view to be presented to the user for them to review prior to them clicking the button to "Place the Order".

So, it is when this page (CheckoutSummary action in my Surface Controller) is requested each time, that the cookie increases in size.

The code for my Checkout Surface Controller is available for review at: https://gist.github.com/xrisdoc/1620f4ae38b1aa19a895b604a656e23d#file-checkoutcontroller-cs

For now, I have tried adding a global filter as @Tom had suggested, to remove the cookie before it reaches a specific size. But, the cookie doesn't seem to be getting removed. Code for this is below:

public class CookieCheckFilterAttribute : ActionFilterAttribute,  IActionFilter
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        HttpCookie merchelloCookie = filterContext.HttpContext.Request.Cookies.Get("merchello");

        if(merchelloCookie != null)
        {
            int maxSize = 2342;
            var size = System.Text.ASCIIEncoding.ASCII.GetByteCount(merchelloCookie.Value);
            if (size >= maxSize)
            {
                filterContext.HttpContext.Request.Cookies.Remove("merchello");
                merchelloCookie.Expires = DateTime.Now.AddDays(-10);
                merchelloCookie.Value = null;
                filterContext.HttpContext.Response.SetCookie(merchelloCookie);
            }
        }

    }
}

@Tom, is there any chance you would you be willing to share your code for your filter? It would be much appreciated!

@Rusty, The issue you posted has been marked as "Fixed" now. So, I assume this will be available when you release version 2.4? If so, I was just wondering when that was likely to be? Or, is there any way I can apply this now?

Thanks!

Hi xrisdoc,

your filter code is almost identical to ours, but we are using the add cookie method, instead of setting it - I think this might be why it isn't working for you.

Full code posted below:

public class CheckCookieSizeFilterAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var merchCookie = filterContext.HttpContext.Request.Cookies["merchello"];
        var maxCookieSize = 2000;

        if (merchCookie != null && Encoding.Unicode.GetByteCount(merchCookie.Value) >= maxCookieSize)
        {
            var newMerchCookie = new HttpCookie("merchello") { Expires = DateTime.Now.AddDays(-1) };
            filterContext.HttpContext.Response.Cookies.Add(newMerchCookie);
        }
    }
}

Hi xrisdoc / Tom,

I've refactored the customer context a bit to store more information directly in the customer / anonymouscustomers extended data collection rather than rely on the now obsolete dictionary (cookie ContextData). There was no noticeable hit to performance, the API did not have to change, aBasnd the changes that were made were not breaking changes - so I considered it a win =)

The code is available in the merchello-dev branch and will be part of the 2.4.0 release. Hopefully we get that out soon, but I'm currently tasked on a sub-project.

Essentially 2.4.0 is complete barring install and update tests. I'm using the build myself via the MyGet feed and have not seen any issues when I updated the project I'm working with. If you go that route, make sure to merge in the App_Plugins/Merchello folder files after you pull in the dlls.

@Tom, Thanks for sharing your code for removing the cookies.

However, it still doesn't seem to be removing the "merchello" cookie. The odd thing is, I have tested this with another cookie that I have created and it does work for for that!

So, it seems that it was just the "merchello" cookie that's not being removed for some reason. Maybe there is something else that is preventing that from being removed at another point. I'll investigate further when when I get a chance.

@Rusty, Thanks for the info!

I have managed to get a build from the merchello-dev branch as you suggested and all seems to be working ok for me too.

Thanks,

Chris