Skip to content

Known Issues & Gotchas

Verified issues with workarounds and prevention strategies

Critical Issues

CRITICAL

Duplicate Order Placement Race Condition

Double-clicking "Place Order" or concurrent API calls can create duplicate orders if the QuoteMutex is not properly used.

Symptoms

  • • Customer charged twice for the same order
  • • Two orders with identical items appear in admin
  • • Inventory decremented twice

Root Cause

The placeOrder operation is not atomic. If two requests hit the same quote before either completes, both may succeed in creating orders.

Workaround

// Always use QuoteMutex for order placement
$this->quoteMutex->execute(
    [$cartId],
    function () use ($quote) {
        // Re-load quote inside mutex to check is_active
        $quote = $this->quoteRepository->get($quote->getId());
        if (!$quote->getIsActive()) {
            throw new LocalizedException(__('Quote already converted'));
        }
        return $this->placeOrder($quote);
    }
);
CRITICAL

Stale Totals After Product Price Change

When product prices are updated in the admin, existing cart items may show outdated prices until the customer modifies their cart.

Symptoms

  • • Cart shows old prices after admin price update
  • • Customer pays different amount than displayed
  • • Price discrepancy between cart and order

Workaround

The UpdateQuoteItems plugin marks quotes for recollection. Ensure this plugin is active and run:

// Force totals recollection on cart access
$quote->setTotalsCollectedFlag(false);
$quote->collectTotals();
$this->quoteRepository->save($quote);
CRITICAL

Guest Cart ID Enumeration Vulnerability

Masked quote IDs are generated using predictable random sources in some configurations, potentially allowing cart enumeration attacks.

Risk

  • • Attackers may access other customers' cart contents
  • • Personal data exposure (addresses, items)
  • • Potential for cart manipulation

Workaround

Implement rate limiting on guest cart endpoints and consider additional validation layers. Magento 2.4.4+ improved masked ID generation entropy.

Major Issues

MAJOR

Incorrect Item Merging with Complex Options

When adding products with complex custom options, items may incorrectly merge or fail to merge based on option comparison logic.

Symptoms

  • • Same product with different options shows as single line
  • • Or opposite: identical items not merging, showing duplicates
  • • Configurable product variants not comparing correctly

Workaround

Implement a custom Quote\Model\Quote\Item\Option\ComparatorInterface that handles your specific option comparison needs.

MAJOR

Address Validation Bypassed via API

REST/GraphQL APIs may not apply the same address validation as the frontend checkout, allowing invalid addresses to be saved.

Symptoms

  • • Orders with incomplete addresses
  • • Missing required fields pass validation
  • • Invalid country/region combinations accepted

Workaround

Add custom validation rules to QuoteValidationComposite that explicitly validate all address fields regardless of entry method.

MAJOR

Shipping Rates Not Refreshed on Address Change

Shipping rates may be cached and not recalculated when the shipping address is updated, showing rates for the previous address.

Workaround

// Force shipping rate recollection
$address->setCollectShippingRates(true);
$address->collectShippingRates();
$quote->collectTotals();
MAJOR

Abandoned Quote Table Bloat

The quote table grows indefinitely with abandoned carts, causing database performance degradation over time.

Impact

  • • Slow cart operations on large tables
  • • Database storage consumption
  • • Slower backups and migrations

Workaround

Configure quote lifetime in admin: Stores > Configuration > Sales > Checkout > Quote Lifetime. Run the quote cleanup cron job regularly.

Minor Issues

MINOR

Coupon Case Sensitivity

Coupon code comparison is case-sensitive in some areas and case-insensitive in others, leading to inconsistent behavior.

Workaround

Standardize all coupon codes to uppercase in your SalesRule configuration and validate input accordingly.

MINOR

Virtual Product Shipping Address

Carts containing only virtual products may still require shipping address input in some checkout configurations.

Workaround

Check $quote->isVirtual() before requiring shipping address in custom checkout implementations.

Prevention Best Practices

Always Use QuoteMutex

Wrap any quote modification that affects order placement in the QuoteMutex to prevent race conditions.

Force Totals Recollection

When displaying cart to customer after any change, call collectTotals() to ensure accurate pricing.

Validate Before Order

Always run the full QuoteValidationComposite before attempting order placement, especially for API integrations.

Clean Old Quotes

Configure quote lifetime and ensure the sales_clean_quotes cron job runs regularly.

Rate Limit Guest APIs

Implement rate limiting on guest cart endpoints to prevent enumeration and abuse attacks.

Test Option Comparison

Test product option comparison thoroughly for configurable, bundle, and custom option products.