Magento2: Customer logged out automatically in checkout process

[Gaboemmi]

Preconditions

1. Magento ver. 2.2.4
2. Current PHP Version: PHP 7.0.28
3. I have tried deleting the browser cache, and doing it from a new incognito tab and from other computers
4. It has installed a module of One Step Checkout, however the error persists with the module enabled and disabled.
5. In the browser's developer console it does not show any errors, it simply redirects me to (.../customer/account/login/) and it takes me out of the session.

Steps to reproduce

1. Create simple product.
2. Navigate to storefront and register customer without address.
3. Add created product to cart as guest.
4. Proceed to checkout.
5. In email field enter created customer email.
6. In appeared password field enter created customer password.
7. Press "Login" button.

Expected result

1. customer is logged in and checkout page is reloaded.

Actual result

1. customer is logged out on checkout page reload

Additional info

To reproduce issue guaranteed put a breakpoint in Magento\CatalogInventory\Observer\QuantityValidatorObserver::execute method.
Issue is caused by duplicated session cookies send after session_regenerate_id() is called.
Possible related to PHP with Apache bug: https://bugs.php.net/bug.php?id=75554&edit=1

[FreekVandeursen]

Duplicate of https://github.com/magento/magento2/issues/12362 ?

[OleksiyOleksiyovych]

We have a similar issue on one our project.
Magento 2.2.4.
Fix from bug #12362 did not help to fix this issue (yes, it fixed log out after some quick reload on the checkout page, but not this issue)

Have someone any ideas how to catch and fix this intermittent issue?

[OleksiyOleksiyovych]

Looks like, we found the reason. It's customer plugin for each action - https://github.com/magento/magento2/blob/2.2/app/code/Magento/Customer/Model/Plugin/CustomerNotification.php

The most easly and fuster way to reproduce this issue is appling coupon on shopping cart page for logged in customer (sometimes you need to apply/cancel couplon several times).

[engcom-backlog-nickolas]

Hello, @Gaboemmi, thank you for your report. Can you please specify, what browser do you use?

[agata-maksymiuk]

Magento 2.2.5 EE - I confirm, the same error.
Easiest way to reproduce is hitting F5 on checkout page several times.

Seems related to:
https://github.com/magento/magento2/issues/13889
https://github.com/magento/magento2/issues/12362

As I investigated, every time /checkout/index/index page is refreshed, it changes session ID (PHPSESSID). It does not happen on other pages. I've tried to remove
$this->_customerSession->regenerateId();
in Magento\Checkout\Controller\Index line 35
and it helped.

I really have no idea why is it here and what it's supposed to do.
This line came from version 0.1.0 and seems completely unnecessary here.

PS. I've even checked Magento 1 Mage_Checkout_OnepageController class to check if there was a line such like this. Nope. This one only appeared in Magento 2 without any corresponding issue.

[engcom-backlog-nickolas]

@Gaboemmi, thank you for your bug report.
We've created internal ticket MAGETWO-93111t o track progress on the issue.

[gx2g]

@agata-maksymiuk I followed your directions and this fixed my problem. The line has been commented out for now. hopefully, Magento 2 will remove this deprecated code that is causing issues. I did a clean upgrade to 2.2.5 and the issue is easily deprecated.

[magento-engcom-team]

Hi @Gaboemmi.

Thank you for your report and collaboration!

The related internal Jira ticket MAGETWO-93861 was closed as non-reproducible in 2.2.x.
It means that Magento team either unable to reproduce this issue using provided _Steps to Reproduce_ from the _Description section_ on clean or the issue has been already fixed in the scope of other tasks.

But if you still run into this problem please update or provide additional information/steps/preconditions in the _Description section_ and reopen this issue.