Same customerID assigned for anonymous purchase followed by registration.

[jskorton]

I am not sure if this is a bug, but I thought it was worth noting.

If you start fresh on the demo site and first buy something anonymously then register you can see the purchase in your view order history. The email address of the purchase can be different from the email address of the registration so long as the sequences of events takes place in the same session.

The use case in which I imagined this to be a bug is when a customer would buy an item anonymously then leave the computer and another person would register using the same web browser. The second person could then see the first person's order in their history.

[apazzolini]

This is occurring because we don't expire sessions after checkout, so if a user registers immediately after buying something, we'll convert their current session to a registered one (which would then link the order they just created).

I'm on the fence about this being a bug, I can see both sides being valid. We might want to consider providing a property that would control this behavior, session.expireAfterCheckout

[bpolster]

I think the property is the right answer