1

This questions is related to this one : anonymous checkout

My company bought a CRM software and I am concerned by the way it stores customers' information.

The website allows anonymous users to have a shopping cart and add products. The website asks them to log in once they want to pay.

The thing is: anonymous customers are stored in the same table than authenticated customers, the only difference is: their email, password, saltkey is empty. The only information we keep is the IP address; when the user logs in we can convert this account into a real one. This table also contains a 'isAdmin' flag.

EDIT: indeed, an asp.net authentication cookie is created to maintain user session.

The question I have: is it a ok practice or is there a possible security issue with this ?

More information: we have 20k 'ghost' users in the database, a maintenance system is available to clean useless records after some time.

EDIT2: my main concerns are :

  • anonymous, authenticated and admin users are in the same table
  • Anonymous users are considered as authenticated users by asp.net, the CRM has its own way to detect if they are really authenticated.
  • Other than performance what security issue could this cause? What is making you concerned? – Richard Tingle Sep 21 '15 at 22:07
  • I have to guess it's also keeping some sort of tracking key or cookie value. IP address is not enough to identify the returning user, and be sure to give the right cart and products. – joshp Sep 22 '15 at 2:34
  • I added more details (see edit and edit2) – Giu Do Sep 22 '15 at 14:00
1

You always have to be careful not to confuse or intermingle Authorization and Authentication. Customers are accounts who can buy stuff on your website and not necessarily ones who can login.

The security risk can come into play if for some reason your code somehow could come up with a customer record for an anonymous customer and grant privileges that require a login.

If your app really needs anonymous customers to have a customer table record then consider having a user table to handle all the login stuff.

-1

So once the ghost user is authenticated, is the ghost record removed or modified? Either way I see no risk here as no personal information is stored until the user is wanting to check out. Amazon has similar functionality if I'm understanding the situation correctly.

  • ... why? this doesn't really answer "why" and seems like it could benefit from an edit helping explain more of that. – enderland Sep 24 '15 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.