A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More

David Ortiz
Oct 11, 2024
  992
(2 votes)

Multiple Anonymous Carts created from external Head front fetching custom Api

Scenario and Problem

Working in a custom headless architecture where a NextJs application hosted in Vercel consumes a custom API built in a Optimizely solution which works as a proxy between Optimizely Commerce Checkout actions (Get Cart, Add to Cart, etc) we faced and issue with guest users and duplicated carts.

The issue was that whenever an anonymous user call to api POST AddToCart , a new cart was created with a different anonymousId. But this was not happening from Postman, where same api method "Add to Cart" was always adding products to the same cart. 

So, from postman we had always the same anonymous cart but from external FE app, a new cart was created in each fetch to the same Api AddToCart.

Solution

The cause of the issue was that from the FETCH that called the API, we were not including the cookies as part of the http request. So, Optimizely was thinking that each request came from a different client, reponding with a different AnonymousId value. 

We realized about it inspecting postman "Cookies" tab that are part of each HTTP request and thinking that maybe our Frontend FETCH code was not including cookies. 

Finally, we found this post specifying that native FETCH API doesn't include cookies by default.

Adding the configuration to include it, everything started to work correctly, sending the same AnonymousId in each request. Anonymous carts duplication error was fixed with that.

https://stackoverflow.com/questions/34558264/fetch-api-with-cookie

In our case, we used the second resolution:

Hope it can be useful for someone else!

Oct 11, 2024

Comments

Sujit Senapati
Sujit Senapati Oct 31, 2024 08:31 PM

I didn't know we could fetch using credentials "include" will include the session cookie information. Good finding.

Please login to comment.
Latest blogs
A day in the life of an Optimizely OMVP: Learning Optimizely Just Got Easier: Introducing the Optimizely Learning Centre

On the back of my last post about the Opti Graph Learning Centre, I am now happy to announce a revamped interactive learning platform that makes...

Graham Carr | Jan 31, 2026

Scheduled job for deleting content types and all related content

In my previous blog post which was about getting an overview of your sites content https://world.optimizely.com/blogs/Per-Nergard/Dates/2026/1/sche...

Per Nergård (MVP) | Jan 30, 2026

Working With Applications in Optimizely CMS 13

💡 Note:  The following content has been written based on Optimizely CMS 13 Preview 2 and may not accurately reflect the final release version. As...

Mark Stott | Jan 30, 2026

Experimentation at Speed Using Optimizely Opal and Web Experimentation

If you are working in experimentation, you will know that speed matters. The quicker you can go from idea to implementation, the faster you can...

Minesh Shah (Netcel) | Jan 30, 2026

How to run Optimizely CMS on VS Code Dev Containers

VS Code Dev Containers is an extension that allows you to use a Docker container as a full-featured development environment. Instead of installing...

Daniel Halse | Jan 30, 2026

A day in the life of an Optimizely OMVP: Introducing Optimizely Graph Learning Centre Beta: Master GraphQL for Content Delivery

GraphQL is transforming how developers query and deliver content from Optimizely CMS. But let's be honest—there's a learning curve. Between...

Graham Carr | Jan 30, 2026