Home
User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
Securing
These topics describe the security features of WebSphere Commerce and how to configure these features.
Session management
Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
Using URL rewriting for session management
Use the Configuration Manager to specify how sessions should be managed.

User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
- Planning
  Creating a custom implementation of a WebSphere Commerce store requires a significant amount of planning. From gathering client needs, to deploying the live solution, much work is needed to successfully deploy a custom client store. Use the resources in here to help you plan every phase of store creation.
- Installing
  Review the following sections for information about installing the WebSphere Commerce product, associated maintenance, and WebSphere Commerce enhancements.
- Migrating
  Before you migrate to WebSphere Commerce Version 8.0, review this information to help plan and execute your migration.
- Deploying
  The topics in this section describe how to publish stores to either a test or production environment, and how to deploy customized code.
- Operating
- Integrating
  Topics in the Integrating category highlight the tasks that are commonly performed for using WebSphere Commerce in combination with other products.
- Administering
- Tutorials
  WebSphere Commerce provides many tutorials to help you customize and understand your WebSphere Commerce instance and stores.
- Samples
- Developing
  The topics in the Developing section describe tasks performed by an application developer.
- Compliance
  The following section describes how you can leverage WebSphere Commerce features and functionality to help your site be compliant with different privacy and security standards.
- Securing
  These topics describe the security features of WebSphere Commerce and how to configure these features.
  - WebSphere Commerce security model
    Authentication is the process of verifying that users or applications are who they claim to be. In a WebSphere Commerce system, authentication is required for all users and applications that access the system, except for guest customers.
  - WebSphere Commerce authentication model
    The WebSphere Commerce authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
  - Authorization
    WebSphere Commerce views access control or authorization as the process of verifying that users or applications have sufficient authority to access a resource. This section describes the details of several aspects of WebSphere Commerce access control.
  - Security standards
    Some main security standards are: NIST SP 800-131A, FIPS 140-2 and PCI.
  - Security bulletins
    WebSphere Commerce releases security bulletins for APARs that address issues that are considered to be security vulnerabilities. These bulletins provide security risk assessment information to help you assess if a particular issue might impact your organization.
  - Security fixes
    The following WebSphere Commerce releases contain security fixes for defects that are considered to be security vulnerabilities. The following details provide security risk assessment information to help you assess if a particular issue might impact your organization.
  - Hardening site security checklist
    To harden the security of your WebSphere Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.
  - Site security considerations
    To enhance the security of your WebSphere Commerce site, you can enable various features in Configuration Manager and the Administration Console.
  - Session management
    Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
    - European Union Data Protection Directive and WebSphere Commerce cookies
      The European Union Data Protection Directive specifies that cookies that are strictly necessary for the delivery of a service requested by the user the consent of the user is not needed. For cookies that are not necessary for the deliver of a service requested by the user, the user must give consent before the cookies or any other form of data is stored in their browser. In WebSphere Commerce, session management cookies are necessary to deliver services requested by the user.
    - Using cookies for session management
      Use the Configuration Manager to enable cookies for session management.
    - Using URL rewriting for session management
      Use the Configuration Manager to specify how sessions should be managed.
    - Using JSP pages for URL rewriting
      If you want to use URL rewriting to maintain session state, do not include links to parts of your Web application in plain HTML files. This restriction is necessary because URL encoding cannot be used in plain HTML files. To maintain state using URL rewriting, every page that the user requests during the session must have code that can be understood by the Java interpreter. If you have such plain HTML files in your Web application and portions of the site that the user might access during the session, convert them to JSP files.
    - Changing session management settings in the WebSphere Commerce configuration file (wc-server.xml)
      You can change various session management settings in the WebSphere Commerce configuration file. For example, if you set the expiration time you can change the tracking behavior of the referral cookie. The referral cookie is used for marketing activities, to track the URL that referred the customer to the WebSphere Commerce site. That is, it tracks the URL that was displayed in the customer's browser immediately before navigating to the WebSphere Commerce site.
    - Enabling multiple logon support for the same user
      Enable multiple logon support to allow for the same authenticated user to use the site from multiple browsers or locations. This feature eliminates the termination of the session and the request to reauthenticate a user, if that same user logs in from a different browser or location.
    - Session invalidation
      Session invalidation ensures that site user sessions are terminated by WebSphere Commerce when specific security-related events or actions take place. Invalidation of stale or maliciously controlled sessions in the context of these events ensures that they cannot be used to interact with the site in the context of the previously verified and active site user.
  - Quick reference to user IDs, passwords, and Web addresses
    Administration in the WebSphere Commerce environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the WebSphere Commerce user IDs, the default passwords are identified.
  - Enabling WebSphere Application Server security
    You can enable WebSphere Application Server security, which includes two orthogonal components: WebSphere global security and Java 2 security.
- Performance
- Troubleshooting

Using URL rewriting for session management

Use the Configuration Manager to specify how sessions should be managed.

Procedure

Open the Configuration Manager.
In the navigation tree for your WebSphere Commerce instance, select WebSphere Commerce > node_name > Commerce > Instance List > instance_name > Instance Properties > Session Management.
Under the General tab on the right, select the appropriate session values including the following:

Enable URL rewriting

Select this check box to use URL rewriting for session management.

Cookie session manager

Select WebSphere Application Server.
Click Apply.
Close the Configuration Manager.
Restart your WebSphere Commerce instance.

What to do next

After completing the steps in order, you must enable URL rewriting in WebSphere Application Server.

For more information, see Configuring session tracking.