nopSolutions/nopCommerce · error · Exception

Anonymous checkout is not allowed

Error message

Anonymous checkout is not allowed

What it means

Thrown by OpcSaveBilling when the current customer is a guest and _orderSettings.AnonymousCheckoutAllowed is false. nopCommerce lets a store forbid guest purchases; this guard blocks an unauthenticated shopper from proceeding through the OPC billing step. The literal message is returned in the JSON error payload and the exception is logged as a warning. It reflects a policy decision, not a bug.

Source

Thrown at src/Presentation/Nop.Web/Controllers/CheckoutController.cs:1538

    {
        try
        {
            //validation
            if (_orderSettings.CheckoutDisabled)
                throw new Exception(await _localizationService.GetResourceAsync("Checkout.Disabled"));

            var customer = await _workContext.GetCurrentCustomerAsync();
            var store = await _storeContext.GetCurrentStoreAsync();
            var cart = await _shoppingCartService.GetShoppingCartAsync(customer, ShoppingCartType.ShoppingCart, store.Id);

            if (!cart.Any())
                throw new Exception("Your cart is empty");

            if (!_orderSettings.OnePageCheckoutEnabled)
                throw new Exception("One page checkout is disabled");

            if (await _customerService.IsGuestAsync(customer) && !_orderSettings.AnonymousCheckoutAllowed)
                throw new Exception("Anonymous checkout is not allowed");

            _ = int.TryParse(form["billing_address_id"], out var billingAddressId);

            if (billingAddressId > 0)
            {
                //existing address
                var address = await _customerService.GetCustomerAddressAsync(customer.Id, billingAddressId)
                              ?? throw new Exception(await _localizationService.GetResourceAsync("Checkout.Address.NotFound"));

                customer.BillingAddressId = address.Id;
                await _customerService.UpdateCustomerAsync(customer);
            }
            else
            {
                if (await _customerService.IsGuestAsync(customer) && _taxSettings.EuVatEnabled && _taxSettings.EuVatEnabledForGuests)
                {
                    var warning = await SaveCustomerVatNumberAsync(model.VatNumber, customer);
                    if (!string.IsNullOrEmpty(warning))

View on GitHub (pinned to 64bdf2ff08)

Solutions

  1. Enable AnonymousCheckoutAllowed in Order settings if guest checkout is desired.
  2. Force authentication before the OPC flow: redirect guests to login/register.
  3. Hide the 'checkout as guest' UI element when the setting is off.
  4. Verify IsGuestAsync classification isn't mis-flagging logged-in customers (e.g. shared/guest customer record issues).

Example fix

// before
orderSettings.AnonymousCheckoutAllowed = false;
// after
orderSettings.AnonymousCheckoutAllowed = true; // permits guest OPC billing
Defensive patterns

Strategy: validation

Validate before calling

// Server-side gate before the OPC billing step: force auth when guests disallowed.
if (await _customerService.IsGuestAsync(customer) && !_orderSettings.AnonymousCheckoutAllowed)
    return RedirectToRoute("Login");

Try / catch

const data = await res.json();
if (data.error && data.message.includes('Anonymous checkout')) {
  // prompt login/register
  location.href = '/login?returnUrl=' + encodeURIComponent(location.pathname);
}

Prevention

When it happens

Trigger: An unauthenticated (guest) customer POSTs the OPC billing step while _orderSettings.AnonymousCheckoutAllowed is false (and IsGuestAsync(customer) returns true). Common when a shop requires accounts but the storefront still surfaces a guest checkout button.

Common situations: Admin disabled anonymous checkout; a marketing entry point (e.g. email link) drops guests straight into checkout; bots/crawlers hitting OPC endpoints unauthenticated; the 'checkout as guest' option left visible in the theme despite the setting.

Related errors

AI-assisted analysis of nopSolutions/nopCommerce@64bdf2ff08 (2026-08-13). Data as JSON: /api/errors/4a59ee5a56fd6d9b. Report an issue: GitHub.