{"record":{"id":"4a59ee5a56fd6d9b","repo":"nopSolutions/nopCommerce","slug":"anonymous-checkout-is-not-allowed-4a59ee","errorCode":null,"errorMessage":"Anonymous checkout is not allowed","messagePattern":"Anonymous checkout is not allowed","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/Presentation/Nop.Web/Controllers/CheckoutController.cs","lineNumber":1538,"sourceCode":"    {\r\n        try\r\n        {\r\n            //validation\r\n            if (_orderSettings.CheckoutDisabled)\r\n                throw new Exception(await _localizationService.GetResourceAsync(\"Checkout.Disabled\"));\r\n\r\n            var customer = await _workContext.GetCurrentCustomerAsync();\r\n            var store = await _storeContext.GetCurrentStoreAsync();\r\n            var cart = await _shoppingCartService.GetShoppingCartAsync(customer, ShoppingCartType.ShoppingCart, store.Id);\r\n\r\n            if (!cart.Any())\r\n                throw new Exception(\"Your cart is empty\");\r\n\r\n            if (!_orderSettings.OnePageCheckoutEnabled)\r\n                throw new Exception(\"One page checkout is disabled\");\r\n\r\n            if (await _customerService.IsGuestAsync(customer) && !_orderSettings.AnonymousCheckoutAllowed)\r\n                throw new Exception(\"Anonymous checkout is not allowed\");\r\n\r\n            _ = int.TryParse(form[\"billing_address_id\"], out var billingAddressId);\r\n\r\n            if (billingAddressId > 0)\r\n            {\r\n                //existing address\r\n                var address = await _customerService.GetCustomerAddressAsync(customer.Id, billingAddressId)\r\n                              ?? throw new Exception(await _localizationService.GetResourceAsync(\"Checkout.Address.NotFound\"));\r\n\r\n                customer.BillingAddressId = address.Id;\r\n                await _customerService.UpdateCustomerAsync(customer);\r\n            }\r\n            else\r\n            {\r\n                if (await _customerService.IsGuestAsync(customer) && _taxSettings.EuVatEnabled && _taxSettings.EuVatEnabledForGuests)\r\n                {\r\n                    var warning = await SaveCustomerVatNumberAsync(model.VatNumber, customer);\r\n                    if (!string.IsNullOrEmpty(warning))\r","sourceCodeStart":1520,"sourceCodeEnd":1556,"githubUrl":"https://github.com/nopSolutions/nopCommerce/blob/64bdf2ff08c8b39e65717bcf974fb43dc2ef68f2/src/Presentation/Nop.Web/Controllers/CheckoutController.cs#L1520-L1556","documentation":"Thrown by OpcSaveBilling when the current customer is a guest and _orderSettings.AnonymousCheckoutAllowed is false. nopCommerce lets a store forbid guest purchases; this guard blocks an unauthenticated shopper from proceeding through the OPC billing step. The literal message is returned in the JSON error payload and the exception is logged as a warning. It reflects a policy decision, not a bug.","triggerScenarios":"An unauthenticated (guest) customer POSTs the OPC billing step while _orderSettings.AnonymousCheckoutAllowed is false (and IsGuestAsync(customer) returns true). Common when a shop requires accounts but the storefront still surfaces a guest checkout button.","commonSituations":"Admin disabled anonymous checkout; a marketing entry point (e.g. email link) drops guests straight into checkout; bots/crawlers hitting OPC endpoints unauthenticated; the 'checkout as guest' option left visible in the theme despite the setting.","solutions":["Enable AnonymousCheckoutAllowed in Order settings if guest checkout is desired.","Force authentication before the OPC flow: redirect guests to login/register.","Hide the 'checkout as guest' UI element when the setting is off.","Verify IsGuestAsync classification isn't mis-flagging logged-in customers (e.g. shared/guest customer record issues)."],"exampleFix":"// before\norderSettings.AnonymousCheckoutAllowed = false;\n// after\norderSettings.AnonymousCheckoutAllowed = true; // permits guest OPC billing","handlingStrategy":"validation","validationCode":"// Server-side gate before the OPC billing step: force auth when guests disallowed.\nif (await _customerService.IsGuestAsync(customer) && !_orderSettings.AnonymousCheckoutAllowed)\n    return RedirectToRoute(\"Login\");","typeGuard":null,"tryCatchPattern":"const data = await res.json();\nif (data.error && data.message.includes('Anonymous checkout')) {\n  // prompt login/register\n  location.href = '/login?returnUrl=' + encodeURIComponent(location.pathname);\n}","preventionTips":["Hide the 'checkout as guest' option when AnonymousCheckoutAllowed is off.","Force authentication before entering checkout.","Audit auth cookie lifetime so users don't silently become guests mid-flow."],"tags":["checkout","opc","config","guest","auth","validation","nopcommerce"],"backgroundTag":null,"analyzedSha":"64bdf2ff08c8b39e65717bcf974fb43dc2ef68f2","analyzedAt":"2026-08-13T21:19:38.062Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}