Home
Documentation
This Help Center provides documentation on all aspects of the HCL Commerce+ product, from installation and deployment to operating and customization.
Securing
These topics describe the security features of Commerce+ and how to configure these features.
Session management
Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
Cookie-based session management
With cookie-based session management, a message (cookie) containing user information is sent to the browser by the web server. This cookie is sent back to the server when the user tries to access certain pages. The cookie allows the server to identify the user and retrieve the user session from the session database, so that the user session is maintained. A cookie-based session ends when the user logs off or closes the browser. Cookie-based session management is secure and has performance benefits over alternatives. For this reason, cookie-based session management is recommended for customer sessions.
Enabling cookies for session management
Enable cookies for session management.
Persistent sessions (Remember Me)
Commerce+ is configured for persistent sessions, meaning that some session-related information of the registered or guest user is stored as permanent cookies. If persistent sessions are enabled, a customer at an Commerce+ store will be recognized on subsequent visits to the store, even after the customer closes the browser. Sessions can be persisted for both guest and registered users. Persistent sessions are enabled by default, and by default, sessions are persisted for 30 days.
Enabling and disabling persistent session for Ruby storefront
Commerce+ can be configured to enable persistent sessions for both registered and guest users. Enabling persistent sessions allows for user session-related information to be stored as permanent cookies. If persistent sessions are enabled, a customer at a Commerce+ store will be recognized on subsequent visits, even after the customer closes the browser.

Documentation
This Help Center provides documentation on all aspects of the HCL Commerce+ product, from installation and deployment to operating and customization.
- Overview
  Welcome to the HCL Commerce+ overview. Explore these feature overviews to learn how Commerce+ operates. Refer to the related links listed at the end of each topic to access expanded product documentation.
- Deploying
  This section provides details on deploying HCL Commerce+. It explains how to download the Docker images and Git bundles that comprise the product, how to create a minimal environment, and how to plan for a full deployment. It details supported software versions, patches, and configurations to ensure the platform performs well.
- Migrating
  The following topics show how to migrate an existing HCL Commerce Version 9.1 environment to Commerce+. The process consists of an initial migration of your database contents. This is followed by a code migration. Both are fully described.
- Operating
  The topics in this section focus on tasks that are performed by business users, marketers, and customer support representatives to connect with partners and attract and satisfy customers.
- Administering
  The site administrator performs the tasks needed to support day to day operations of the Commerce+ site.
- Extending
  Using Commerce+'s xC programming model, you can use HCL-provided extension points to extend existing Commerce logic. You can implement these extensions with the xC Customization toolkit provided by HCL. Commerce+ also provides Packaged Business Capability integrations that extend the product's reach and functionality.
- Securing
  These topics describe the security features of Commerce+ and how to configure these features.
  - Non-applicable security vulnerabilities
    The Commerce+ team has evaluated the following security vulnerabilities identified within the Commerce+ stack and determined there is no impact to default deployments.
  - Commerce+ security model
    Authentication is the process of verifying that users or applications are who they claim to be. In an Commerce+ system, authentication is required for all users and applications that access the system, except for guest customers.
  - Commerce+ authentication model
    The Commerce+ authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
  - Authorization
    Commerce+ views access control or authorization as the process of verifying that users or applications have sufficient authority to access a resource. This section describes the details of several aspects of Commerce+ access control.
  - Hardening site security checklist
    To harden the security of your HCL Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.
  - Site security considerations
    To enhance the security of your Commerce+ site, you can enable various features in Administration Console or in the Commerce+ configuration file.
  - Session management
    Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
    - Store-level session management
      Store level user session management enables access control for a user and their roles across multiple stores.
    - Cookie-based session management
      With cookie-based session management, a message (cookie) containing user information is sent to the browser by the web server. This cookie is sent back to the server when the user tries to access certain pages. The cookie allows the server to identify the user and retrieve the user session from the session database, so that the user session is maintained. A cookie-based session ends when the user logs off or closes the browser. Cookie-based session management is secure and has performance benefits over alternatives. For this reason, cookie-based session management is recommended for customer sessions.
      - European Union Data Protection Directive and Commerce+ cookies
        The European Union Data Protection Directive specifies that cookies that are strictly necessary for the delivery of a service requested by the user the consent of the user is not needed. For cookies that are not necessary for the deliver of a service requested by the user, the user must give consent before the cookies or any other form of data is stored in their browser. In Commerce+, session management cookies are necessary to deliver services requested by the user.
      - Enabling cookies for session management
        Enable cookies for session management.
        Persistent sessions (Remember Me)
        Commerce+ is configured for persistent sessions, meaning that some session-related information of the registered or guest user is stored as permanent cookies. If persistent sessions are enabled, a customer at an Commerce+ store will be recognized on subsequent visits to the store, even after the customer closes the browser. Sessions can be persisted for both guest and registered users. Persistent sessions are enabled by default, and by default, sessions are persisted for 30 days.
        Enabling global persistent sessions
        Commerce+ can be configured to enable persistent sessions for both registered and guest users. Enabling persistent sessions allows for some session-related information of the user to be stored as permanent cookies. If persistent sessions are enabled, a customer at a Commerce+ store will be recognized on subsequent visits to the store, even after the customer closes the browser.
        Enabling persistent sessions in JSP based store
        Persistent sessions are useful in B2C stores, although it is possible to enable B2B direct stores with persistent sessions as well. The steps to enable persistent sessions in the stores differ only in the locations and names of the files that need to be altered. In both cases, the store's Logon and UserRegistrationAdd forms require changes. The steps must be completed for all the stores in the site that need persistent sessions.
        Enabling persistent session for React based store
        Enable persistent session and remember me features in the React-based store for a faster login to your store. This feature is available on Commerce+ version 9.1.10.0 and greater.
        Enabling and disabling persistent session for Ruby storefront
        Commerce+ can be configured to enable persistent sessions for both registered and guest users. Enabling persistent sessions allows for user session-related information to be stored as permanent cookies. If persistent sessions are enabled, a customer at a Commerce+ store will be recognized on subsequent visits, even after the customer closes the browser.
        Personalization ID
        The Personalization ID identifies a user and allows Commerce+ to present them with personalized content when the user interacts with the business, throughout the business lifecycle.
    - Changing session management settings in the Commerce+ configuration file (wc-server.xml)
      You can change various session management settings in the Commerce+ configuration file. For example, if you set the expiration time you can change the tracking behavior of the referral cookie. The referral cookie is used for marketing activities, to track the URL that referred the customer to the Commerce+ site. That is, it tracks the URL that was displayed in the customer's browser immediately before navigating to the Commerce+ site.
    - Enabling multiple logon support for the same user
      Enable multiple logon support to allow for the same authenticated user to use the site from multiple browsers or locations. This feature eliminates the termination of the session and the request to reauthenticate a user, if that same user logs in from a different browser or location.
    - Session timeout
      After a set period of inactivity, user sessions are automatically logged off when session timeout is enabled. This applies to users that have logged into Commerce+; not guest sessions. Session timeout settings can be changed based on the security requirements of your site. Session timeout does not apply to requests that are cached and bypass the Commerce+ session management code.
    - Session invalidation
      Session invalidation ensures that site user sessions are terminated by Commerce+ when specific security-related events or actions take place. Invalidation of stale or maliciously controlled sessions in the context of these events ensures that they cannot be used to interact with the site in the context of the previously verified and active site user.
  - Quick reference to user IDs, passwords, and Web addresses
    Administration in the Commerce+ environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the Commerce+ user IDs, the default passwords are identified.
- Performance
  Topics in the Performance section describe the means by which to plan, implement, test, and re-visit the optimization of Commerce+ site performance.
- Troubleshooting
  Topics in the Troubleshooting section highlight common issues that are encountered with Commerce+, and how they can be addressed or mitigated.
- Reference
  Topics in the Reference section contain all of the Commerce+ reference documentation.

Enabling and disabling persistent session for Ruby storefront

Commerce+ can be configured to enable persistent sessions for both registered and guest users. Enabling persistent sessions allows for user session-related information to be stored as permanent cookies. If persistent sessions are enabled, a customer at a Commerce+ store will be recognized on subsequent visits, even after the customer closes the browser.

Before you begin

Make sure you complete the procedure for Enabling global persistent sessions.

About this task

By default, the Remember Me feature is enabled in the Next.js store. If the Commerce+ Transaction server has the global persistent session disabled, the Remember Me feature needs to be disabled in the store.

To disable the Remember Me feature, follow the customization procedure of the Next.js store and overwrite the following components by removing the Remember Me checkbox:

presentation/components/core/content/Login/parts/LoginChangePasswordForm.tsx
presentation/components/core/content/Login/parts/LoginForm.tsx
presentation/components/core/content/Register/index.tsx

Results

The Remember Me feature is disabled for the Next.js store.