A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More

David Ortiz
Oct 11, 2024
  900
(2 votes)

Multiple Anonymous Carts created from external Head front fetching custom Api

Scenario and Problem

Working in a custom headless architecture where a NextJs application hosted in Vercel consumes a custom API built in a Optimizely solution which works as a proxy between Optimizely Commerce Checkout actions (Get Cart, Add to Cart, etc) we faced and issue with guest users and duplicated carts.

The issue was that whenever an anonymous user call to api POST AddToCart , a new cart was created with a different anonymousId. But this was not happening from Postman, where same api method "Add to Cart" was always adding products to the same cart. 

So, from postman we had always the same anonymous cart but from external FE app, a new cart was created in each fetch to the same Api AddToCart.

Solution

The cause of the issue was that from the FETCH that called the API, we were not including the cookies as part of the http request. So, Optimizely was thinking that each request came from a different client, reponding with a different AnonymousId value. 

We realized about it inspecting postman "Cookies" tab that are part of each HTTP request and thinking that maybe our Frontend FETCH code was not including cookies. 

Finally, we found this post specifying that native FETCH API doesn't include cookies by default.

Adding the configuration to include it, everything started to work correctly, sending the same AnonymousId in each request. Anonymous carts duplication error was fixed with that.

https://stackoverflow.com/questions/34558264/fetch-api-with-cookie

In our case, we used the second resolution:

Hope it can be useful for someone else!

Oct 11, 2024

Comments

Sujit Senapati
Sujit Senapati Oct 31, 2024 08:31 PM

I didn't know we could fetch using credentials "include" will include the session cookie information. Good finding.

Please login to comment.
Latest blogs
Building simple Opal tools for product search and content creation

Optimizely Opal tools make it easy for AI agents to call your APIs – in this post we’ll build a small ASP.NET host that exposes two of them: one fo...

Pär Wissmark | Dec 13, 2025 |

CMS Audiences - check all usage

Sometimes you want to check if an Audience from your CMS (former Visitor Group) has been used by which page(and which version of that page) Then yo...

Tuan Anh Hoang | Dec 12, 2025

Data Imports in Optimizely: Part 2 - Query data efficiently

One of the more time consuming parts of an import is looking up data to update. Naively, it is possible to use the PageCriteriaQueryService to quer...

Matt FitzGerald-Chamberlain | Dec 11, 2025 |

Beginner's Guide for Optimizely Backend Developers

Developing with Optimizely (formerly Episerver) requires more than just technical know‑how. It’s about respecting the editor’s perspective, ensurin...

MilosR | Dec 10, 2025