QUALITY PATCH

ACSD-52906: X-Magento-Vary cookie is set incorrectly for logged-in customers that belong to the same…

X-Magento-Vary cookie is set incorrectly for logged-in customers that belong to the same customer segment, causing improper caching for some pages. Quality patch ACSD-52906 for magento/module-customer applies to Magento Open Source and Adobe Commerce 2.3.7 to 2.4.6-p15.

Categories
Cache
Components
magento/module-customer, magento/module-customer-segment
Origin
adobe-commerce-support
Since QPT
1.1.36

Issue

X-Magento-Vary cookie is set incorrectly for logged-in customers that belong to the same customer segment, causing improper caching for some pages.

Steps to reproduce

1. Configure Varnish or Fastly cache. 1. Create a new customer segment and assign it to the Registered customers. 1. Create two customers, e.g., customer1 and customer2. 1. Clear the cache. 1. Sign in as customer1 and go to the home page. 1. Open an incognito page on your browser. 1. Go to any page other than the home page. 1. Log in as customer2. 1. Go to the home page. 1. Check if the page is cached in the browser dev console.

Adobe's page lists 2.3.7 - 2.4.6-p2 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.7.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-52906. On Cloud, add ACSD-52906 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-52906/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Packages across compatible versions (1): magento/module-customer
Packages across compatible versions (2): magento/module-customer, magento/module-customer-segment

magento/magento2-base >=2.3.7 <2.4.7

Magento Open Source
2.4.6-p15, 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p17, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p18, 2.4.4-p17, 2.4.4-p16, 2.4.4-p15, 2.4.4-p14, 2.4.4-p13, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4, 2.4.3-p3, 2.4.3-p2, 2.4.3-p1, 2.4.3, 2.4.2-p2, 2.4.2-p1, 2.4.2, 2.4.1-p1, 2.4.1, 2.4.0-p1, 2.4.0, 2.3.7-p4, 2.3.7-p3, 2.3.7-p2, 2.3.7-p1, 2.3.7
Adobe Commerce
2.4.6-p15, 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p17, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p18, 2.4.4-p17, 2.4.4-p16, 2.4.4-p15, 2.4.4-p14, 2.4.4-p13, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4, 2.4.3-p3, 2.4.3-p2, 2.4.3-p1, 2.4.3, 2.4.2-p2, 2.4.2-p1, 2.4.2, 2.4.1-p1, 2.4.1, 2.4.0-p1, 2.4.0, 2.3.7-p4, 2.3.7-p3, 2.3.7-p2, 2.3.7-p1, 2.3.7
Patch file
patches/os/ACSD-52906_2.4.4-p3.patch
  • vendor/magento/module-customer/Model/App/Action/ContextPlugin.php
  • vendor/magento/module-customer/Model/Session.php

Sources

Łukasz Bajsarowicz
Built by

Łukasz Bajsarowicz, e-commerce architect

Magento and Adobe Commerce architecture, upgrades, performance and audits for merchants and agencies since 2015; magento.watch is the tooling I use on those projects.

Open source, maintained on weekends.