Hi,

The Store module create a cookie when the visitor add a product to his cart. The cookie contains only two values: the CartGuid (to identify the visitor cart) and the OrderID (when the checkout process begin). Both values are stored in clear text, but if you want to enhance your security you can check the setting 'Secure Cookie' under Store Admin. In this case, both values will be encrypted using the algorithm defined in your web.config, by default DotNetNuke use 3DES. Algorithm use the ValidationKey for the key and the DecryptionKey for the IV, because those values are created at install and are always different for two DNN instances, it's almost impossible to guess how to decrypt the cookie values. You can have a look at the class SymmetricHelper.cs in the source code for details. The cookie name look like: DotNetNuke_Store_Portal_n, where 'n' is the current PortalId. Finaly, the cookie expire when you close your browser or when the session expire.

Typical Unencrypted Cookie:

Name: DotNetNuke_Store_Portal_0
Value: CartID=b4c409c8-2ea0-4ffe-ad7f-00c107e88fd2&OrderID=3114

The same with encryption enabled:

Name: DotNetNuke_Store_Portal_0
Value: CartID=WGBfXn+hyQpkdjvEVnHExq6K8d8AsarB7SVaC0ObkiA0A1yIeNv+nMaayImVcmkd3DPmEXYrmYV8jGxWWMQ/9PAkTu/BaBZZ3UoI5coOLnA=&OrderID=2vA855Gy6U1iAzeG6FvWlQ==

Gilles

---

We (team members) are Humans offering their knowledge, their work and their spare time FOR FREE to benefit the community. It would be so particularly appreciated that your messages begin with "Hello" and end with "Thank you" or any other form of politeness. Ask yourself what your reaction would be, if you were approached by me (a total stranger) on the street to ask you something without saying "Hello" nor "Thank you"? After several years of services dedicated to the community, I begin to be tired to read requests without any form of politeness.