Home
Documentation
HCL Commerce is a high-availability, highly scalable and customizable e-commerce platform. Able to support hundreds of thousands of transactions per day, HCL Commerce allows you to do business with consumers (B2C) or directly with businesses (B2B). HCL Commerce uses cloud friendly technology to make deployment and operation both easy and efficient. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels. Business users can also use AI enabled content management capabilities.
Securing
These topics describe the security features of HCL Commerce and how to configure these features.
Session management
Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
Using URL rewriting for session management
URL rewriting manages sessions by appending unique session IDs to all links and redirects returned to the browser, allowing the server to identify users without cookies. This method is incompatible with HCL Commerce dynamic caching; therefore, you must disable caching if you enable URL rewriting. To ensure links are rewritten correctly, you must use JSP pages for display purposes, as static HTML files are not supported. Because session IDs appear in the URL string, instruct users to log off at the end of their visit to prevent unauthorized access to session data through browser history.

Documentation
HCL Commerce is a high-availability, highly scalable and customizable e-commerce platform. Able to support hundreds of thousands of transactions per day, HCL Commerce allows you to do business with consumers (B2C) or directly with businesses (B2B). HCL Commerce uses cloud friendly technology to make deployment and operation both easy and efficient. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels. Business users can also use AI enabled content management capabilities.
- Getting started
  HCL Commerce has different advantages for business users, administrators and developers. HCL Commerce targets each of these roles with a tailored set of offerings so that each of your users can get maximum benefit.
- Installing and deploying
  Learn how to install and deploy HCL Commerce development environments and HCL Commerce production environments.
- Migrating
  Before you migrate to HCL Commerce Version 9, review this information to help plan and execute your migration.
- Operating
  Topics in the Operating category highlight tasks that are typically performed by business users, customer support representatives, to complete their day-to-day tasks in the operation of the HCL Commerce site.
- Integrating
  Topics in the Integrating category highlight the tasks that are commonly performed for using HCL Commerce in combination with other products.
- Administering
  Topics in the Administering category highlight tasks that are typically performed by the Site Administrator, to support daily operations of the HCL Commerce site.
- Customizing
  The topics in the Customizing section describe tasks performed by an application developer to customize HCL Commerce.
- Tutorials
  HCL Commerce provides many tutorials to help you customize and understand your HCL Commerce instance and stores.
- Samples
  Topics in the Samples category highlight the various samples that are provided with HCL Commerce.
- Compliance
  The following section describes how you can leverage HCL Commerce features and functionality to help your site be compliant with different privacy and security standards.
- Securing
  These topics describe the security features of HCL Commerce and how to configure these features.
  - HCL Commerce security model
    Authentication is the process of verifying that users or applications are who they claim to be. In an HCL Commerce system, authentication is required for all users and applications that access the system, except for guest customers.
  - HCL Commerce authentication model
    The HCL Commerce authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
  - Authorization
    HCL Commerce views access control or authorization as the process of verifying that users or applications have sufficient authority to access a resource. This section describes the details of several aspects of HCL Commerce access control.
  - Hardening site security checklist
    To harden the security of your HCL Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.
  - Site security considerations
    To enhance the security of your HCL Commerce site, you can enable various features in Administration Console or in the HCL Commerce configuration file.
  - Session management
    Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
    - Store-level session management
      Store level user session management enables access control for a user and their roles across multiple stores.
    - Cookie-based session management
      Cookie-based session management identifies shoppers and maintains their session state to provide a seamless shopping experience. By using a combination of session and authentication cookies, the store remembers shopper preferences, such as language and currency, while protecting sensitive data during checkout. This method is the recommended standard for customer sessions because it balances high performance with robust security. To maintain privacy, especially on shared devices, shoppers should always sign out at the end of their visit to ensure their session information is cleared.
    - Using URL rewriting for session management
      URL rewriting manages sessions by appending unique session IDs to all links and redirects returned to the browser, allowing the server to identify users without cookies. This method is incompatible with HCL Commerce dynamic caching; therefore, you must disable caching if you enable URL rewriting. To ensure links are rewritten correctly, you must use JSP pages for display purposes, as static HTML files are not supported. Because session IDs appear in the URL string, instruct users to log off at the end of their visit to prevent unauthorized access to session data through browser history.
      - Enabling or disabling URL rewriting
        Modify the wc-server.xml file to specify how sessions should be managed.
      - Using JSP pages for URL rewriting
        If you want to use URL rewriting to maintain session state, do not include links to parts of your Web application in plain HTML files. This restriction is necessary because URL encoding cannot be used in plain HTML files. To maintain state using URL rewriting, every page that the user requests during the session must have code that can be understood by the Java interpreter. If you have such plain HTML files in your Web application and portions of the site that the user might access during the session, convert them to JSP files.
    - Changing session management settings in the HCL Commerce configuration file (wc-server.xml)
      You can change various session management settings in the HCL Commerce configuration file. For example, if you set the expiration time you can change the tracking behavior of the referral cookie. The referral cookie is used for marketing activities, to track the URL that referred the customer to the HCL Commerce site. That is, it tracks the URL that was displayed in the customer's browser immediately before navigating to the HCL Commerce site.
    - Enabling multiple logon support for the same user
      Enable multiple logon support to allow for the same authenticated user to use the site from multiple browsers or locations. This feature eliminates the termination of the session and the request to reauthenticate a user, if that same user logs in from a different browser or location.
    - Session timeout
      After a set period of inactivity, user sessions are automatically logged off when session timeout is enabled. This applies to users that have logged into HCL Commerce; not guest sessions. Session timeout settings can be changed based on the security requirements of your site. Session timeout does not apply to requests that are cached and bypass the HCL Commerce session management code.
    - Session invalidation
      Session invalidation ensures that site user sessions are terminated by HCL Commerce when specific security-related events or actions take place. Invalidation of stale or maliciously controlled sessions in the context of these events ensures that they cannot be used to interact with the site in the context of the previously verified and active site user.
  - Quick reference to user IDs, passwords, and Web addresses
    Administration in the HCL Commerce environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the HCL Commerce user IDs, the default passwords are identified.
  - Enabling WebSphere Application Server security
    You can enable WebSphere Application Server security, which includes two orthogonal components: WebSphere global security and Java 2 security.
- Performance
  Topics in the Performance section describe the means by which to plan, implement, test, and re-visit the optimization of HCL Commerce site performance.
- Troubleshooting
  Topics in the Troubleshooting section highlight common issues that are encountered with HCL Commerce, and how they can be addressed or mitigated.
- Reference
  Topics in the Reference section contain all of the HCL Commerce reference documentation.

Deprecated feature

Using URL rewriting for session management

Deprecated: Using URL rewriting for session management was deprecated in HCL Commerce Version 9.

Recommended action: Use cookie-based session management.

URL rewriting manages sessions by appending unique session IDs to all links and redirects returned to the browser, allowing the server to identify users without cookies. This method is incompatible with HCL Commerce dynamic caching; therefore, you must disable caching if you enable URL rewriting. To ensure links are rewritten correctly, you must use JSP pages for display purposes, as static HTML files are not supported. Because session IDs appear in the URL string, instruct users to log off at the end of their visit to prevent unauthorized access to session data through browser history.

Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.

Important: HCL Commerce dynamic caching and URL rewriting cannot be used together. If URL rewriting is enabled, then you must disable HCL Commerce dynamic caching.

To use URL rewriting, HTML files (files with .html or .htm extensions) cannot be used for links. To use URL rewriting, JSP pages must be used for display purposes. A session with URL rewriting expires when the customer logs off.

Because URLs returned to the browser contain session IDs, another user with access to the browser history (for example, on a shared computer) might gain access to sensitive information exchanged during a session - if the session is left active. To prevent such unauthorized access, site developers can add a notice to their site to tell customers to always log off at the end of their visit so that their session ends, particularly on a shared computer.