How does the session behave for logged‑in and non‑logged‑in frontend users?

Overview

Understanding how sessions are handled in the TYPO3 Shop helps you plan a smooth customer journey from product discovery to checkout. The shop uses TYPO3’s frontend session mechanism to store cart data and related state. Behavior differs depending on whether a visitor is anonymous or authenticated.

Non‑logged‑in users (anonymous sessions)

A lightweight anonymous session is created on demand as soon as the visitor interacts with stateful features (e.g., adds a product to the basket).
The basket is stored in the TYPO3 FE session and identified by a session cookie in the browser.
If the visitor opens the shop in another browser or device, the basket does not transfer automatically.
Session duration and garbage collection depend on TYPO3’s configuration (e.g., FE session lifetime) and browser settings.

Logged‑in users (authenticated sessions)

When a customer signs in, the shop ties the basket and relevant state to the authenticated frontend user.
If the user already had an anonymous basket, the shop merges it into the user’s basket during login to avoid losing items.
Logged‑in sessions typically persist longer within the configured lifetime and allow restoring the cart across page views and actions.

Basket merge on login

On login, any existing anonymous basket is merged with the user’s persisted basket. Duplicates are combined by quantity, and the final result is saved under the authenticated user.
This ensures that items added before logging in are not lost.

Session lifetime and invalidation

The effective lifetime is defined by TYPO3 core configuration (cookie lifetime, session settings) and server cleanup.
Clearing browser cookies or using private mode resets the anonymous basket.
Logging out ends the authenticated session; a new anonymous session may start on further interaction.

Caching considerations

Shop pages with personalized data (basket, profile) are delivered uncached or with user‑specific fragments to ensure consistency.
If you use reverse proxies or additional caching, exclude basket and checkout routes from caching.

Troubleshooting checklist

Basket items “disappear”: check cookie settings, domain/path consistency, and FE session lifetime.
After login items are missing: verify the basket‑merge logic is active and no custom code clears the session prematurely.
Different domains (e.g., www vs. bare domain): ensure consistent cookie domain settings so the same cookie is sent.

Best practices

Encourage login or sign‑up before checkout to improve cart persistence across devices.
Keep FE session lifetime reasonable (long enough for typical shopping, short enough for security).
For multi‑site projects, align cookie domain and SameSite settings with your deployment.

Conclusion

Anonymous visitors get a temporary, cookie‑based basket; upon login, their basket is merged and persisted under the user account. This avoids data loss and ensures a seamless checkout experience.