Let guests check out without an account

How to do it

Forcing an account before payment loses buyers and collects data you do not need. Store the guest cart on the server under a token of at least 128 random bits, as Make tokens from a secure random source says. Send it in a cookie marked HttpOnly, Secure and SameSite=Lax. Keep only variant IDs and quantities in it, never prices. Expire guest carts after a fixed time, such as 30 days. Offer an account after the order, with the email already filled in. Order lookup sends a link to the order's email address instead of showing the order to anyone with the number. Compare emails in one form, as Compare email addresses and usernames in one canonical form shows.

Examples

TypeScript example

import { randomBytes } from 'node:crypto';
const CART_DAYS = 30;

export function newGuestCart(res: Response) {
  const token = randomBytes(32).toString('base64url');
  res.cookie('cart', token, { httpOnly: true, secure: true, sameSite: 'lax', maxAge: CART_DAYS * 86_400_000 });
  return token;
}

Python example

import secrets
CART_DAYS = 30

def new_guest_cart(response) -> str:
    token = secrets.token_urlsafe(32)
    response.set_cookie("cart", token, httponly=True, secure=True, samesite="Lax", max_age=CART_DAYS * 86_400)
    return token

How to check

A browser test buys a product with no account and gets a confirmation email. A lookup with that order number and another email address shows nothing and sends nothing. The cart cookie has HttpOnly, Secure and SameSite set.

Related rules

• SEC-32 Make tokens from a secure random source in Adversarial testing
• ACC-4 Compare email addresses and usernames in one canonical form in Accounts and identity