A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More

David Ortiz
Oct 11, 2024
  905
(2 votes)

Multiple Anonymous Carts created from external Head front fetching custom Api

Scenario and Problem

Working in a custom headless architecture where a NextJs application hosted in Vercel consumes a custom API built in a Optimizely solution which works as a proxy between Optimizely Commerce Checkout actions (Get Cart, Add to Cart, etc) we faced and issue with guest users and duplicated carts.

The issue was that whenever an anonymous user call to api POST AddToCart , a new cart was created with a different anonymousId. But this was not happening from Postman, where same api method "Add to Cart" was always adding products to the same cart. 

So, from postman we had always the same anonymous cart but from external FE app, a new cart was created in each fetch to the same Api AddToCart.

Solution

The cause of the issue was that from the FETCH that called the API, we were not including the cookies as part of the http request. So, Optimizely was thinking that each request came from a different client, reponding with a different AnonymousId value. 

We realized about it inspecting postman "Cookies" tab that are part of each HTTP request and thinking that maybe our Frontend FETCH code was not including cookies. 

Finally, we found this post specifying that native FETCH API doesn't include cookies by default.

Adding the configuration to include it, everything started to work correctly, sending the same AnonymousId in each request. Anonymous carts duplication error was fixed with that.

https://stackoverflow.com/questions/34558264/fetch-api-with-cookie

In our case, we used the second resolution:

Hope it can be useful for someone else!

Oct 11, 2024

Comments

Sujit Senapati
Sujit Senapati Oct 31, 2024 08:31 PM

I didn't know we could fetch using credentials "include" will include the session cookie information. Good finding.

Please login to comment.
Latest blogs
A day in the life of an Optimizely OMVP - OptiGraphExtensions v2.0: Enhanced Search Control with Language Support, Synonym Slots, and Stop Words

Supercharge your Optimizely Graph search experience with powerful new features for multilingual sites and fine-grained search tuning. As search...

Graham Carr | Dec 16, 2025

A day in the life of an Optimizely OMVP - Optimizely Opal: Specialized Agents, Workflows, and Tools Explained

The AI landscape in digital experience platforms has shifted dramatically. At Opticon 2025, Optimizely unveiled the next evolution of Optimizely Op...

Graham Carr | Dec 16, 2025

Optimizely CMS - Learning by Doing: EP09 - Create Hero, Breadcrumb's and Integrate SEO : Demo

  Episode 9  is Live!! The latest installment of my  Learning by Doing: Build Series  on  Optimizely Episode 9 CMS 12  is now available on YouTube!...

Ratish | Dec 15, 2025 |

Building simple Opal tools for product search and content creation

Optimizely Opal tools make it easy for AI agents to call your APIs – in this post we’ll build a small ASP.NET host that exposes two of them: one fo...

Pär Wissmark | Dec 13, 2025 |