Hi Smita,
Which version of Magento are you using?
This issues was fixed in the Magento 1.9.1 version. Visit the release notes https://docs.magento.com/m1/ce/user_guide/magento/release-notes-ce-1.9.1.html
and see the following section.
Security Enhancements
- To change an administrator password from the Admin, you must first enter the existing password.
- Customer passwords are no longer stored in clear text during registration.
- Customers in the store can no longer see the names of other users, as had been reported in certain circumstances.
- Added a secure cookie flag for the storefront to prevent man-in-the-middle attacks. There is no change to the Secure and Unsecure Web configuration options
You may check \app\code\core\Mage\Core\Model\Session\Abstract\Varien.php file for the code changes.
There is following code section
if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
// secure cookie check to prevent MITM attack
$secureCookieName = $sessionName . '_cid';
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
if ($_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))) {
session_regenerate_id(false);
$sessionHosts = $this->getSessionHosts();
$currentCookieDomain = $cookie->getDomain();
foreach (array_keys($sessionHosts) as $host) {
// Delete cookies with the same name for parent domains
if (strpos($currentCookieDomain, $host) > 0) {
$cookie->delete($this->getSessionName(), null, $host);
}
}
$_SESSION = array();
} else {
/**
* Renew secure cookie expiration time if secure id did not change
*/
$cookie->renew($secureCookieName, null, null, null, true, null);
}
}
if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
$checkId = Mage::helper('core')->getRandomString(16);
$cookie->set($secureCookieName, $checkId, null, null, null, true);
$_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
}
}
If you are on lower version of Magento you can update to higher version or you may have to extend this file in local code pool.
