cfgalvani

Sauce: https://community.magento.com/t5/Technical-Issues/Cookies-frontend-cid-is-never-renewed-compared-to-frontend-one/td-p/41077

The core code seems to have forgotten to include the logic to renew the frontend_cid cookie.
 
I have contacted Magento support regarding this and they provided me a patch - SUPEE-7136, however I'm not seeing it published online anywhere...
 
The issue lies in this file:
app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
 
What the patch does is replace this:

cfgalvani

find -L app/design/frontend -regex '.*\(shipping\|billing\|shipping_method\|payment\).phtml' -exec grep -L formkey {} \; \
  | xargs sed -i 's/<\/form>/<?php echo $this->getBlockHtml("formkey") ?><\/form>/g'
  
find -L skin/frontend -name 'opcheckout.js' -exec grep -L form_key {} \; \
  | xargs sed -i 's/if (elements\[i\].name=='\''payment\[method\]'\'') {/if (elements[i].name=='\''payment[method]'\'' || elements[i].name == '\''form_key'\'') {/g'

cfgalvani

        location ~* "(eval\()"  { deny all; }
        location ~* "(127\.0\.0\.1)"  { deny all; }
        location ~* "([a-z0-9]{2000})"  { deny all; }
        location ~* "(javascript\:)(.*)(\;)"  { deny all; }
        location ~* "(base64_encode)(.*)(\()"  { deny all; }
        location ~* "(GLOBALS|REQUEST)(=|\[|%)"  { deny all; }
        location ~* "(<|%3C).*script.*(>|%3)" { deny all; }
        location ~ "(\\|\.\.\.|\.\./|~|`|<|>|\|)" { deny all; }
        location ~* "(boot\.ini|etc/passwd|self/environ)" { deny all; }
        location ~* "(thumbs?(_editor|open)?|tim(thumb)?)\.php" { deny all; }