fix(vue-starter-template): validate checkout and restore guest orders by patzick · Pull Request #2724 · shopware/frontends

Patryk Tomczyk (patzick) · 2026-09-16T09:50:09Z

Description

Checkout in vue-starter-template sent the register/order request even when required fields like email were never touched, guest checkout could not complete from the UI, and clicking Create customer account had no way back to guest mode.

This change:

Validates email and billing address on Confirm and place order even if the fields were never focused, and shows the errors on the fields instead of calling the Store API
Keeps guest checkout as the default (guest: true, empty password) and adds a Continue as guest control after the password field appears
Requires zip code (and state when the selected country has states) before registration
Removes the extra Next button from one-page checkout. Confirm and place order creates the guest session (POST /account/register with guest: true, which does not create an account) and then places the order (POST /checkout/order)
Resolves storefrontUrl from the current sales channel domains when the configured devStorefrontUrl is not listed, so guest register can succeed against the public demo API and checkout can reach POST /checkout/order
Points devStorefrontUrl at https://frontends-starter-template.vercel.app as the preferred storefront URL

Relates to the guest/account toggle issues around #2683 and the checkout flow from #2700.

Type of change

Bug fix (non-breaking change that fixes an issue)

ToDo's

Screenshots (if applicable)

Empty form, Confirm and place order (no field focused): client-side required errors, including email.

Create customer account reveals password and a way back:

Continue as guest restores guest mode:

Walkthrough recording:

checkout_untouched_validation_and_guest_toggle.mp4

Additional context

Verified with the Store API: POST /checkout/order without a customer returns FRAMEWORK__ROUTING_CUSTOMER_NOT_LOGGED_IN. Guest checkout must call POST /account/register with guest: true first, then POST /checkout/order.

The public demo sales channel currently lists only https://demo-frontends.shopware.store/figma. Registering with the starter Vercel host as storefrontUrl is rejected (VIOLATION::NO_SUCH_CHOICE_ERROR), which is why place-order previously never reached /checkout/order. getStorefrontUrl() now falls back to a domain from the session context in that case.

Show client-side errors on submit even when fields were never focused, keep guest checkout as the default with a way back from create-account, and require zip/state before the register request is sent.

vercel · 2026-09-16T09:51:51Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
frontends-starter-template-extended	Skipped		Sep 16, 2026 4:39pm UTC
frontends-vue-starter-template	Skipped		Sep 16, 2026 4:39pm UTC

Point registration storefrontUrl at https://frontends-starter-template.vercel.app instead of the deprecated demo-store domain.

cursor · 2026-09-16T10:29:52Z

Browser walkthrough of the starter checkout fixes (untouched-field validation, create-account / continue-as-guest toggle, filled guest form).

Empty form after Next — required errors on untouched fields, including email:

Untouched checkout fields show required errors

Create customer account shows the password field and Continue as guest:

Create account shows password and Continue as guest

Continue as guest hides the password field again:

Continue as guest hides the password field

Recording:

checkout_untouched_validation_and_guest_toggle.mp4

Add the browser verification images and compressed recording so they can be shown inline on the pull request.

cursor · 2026-09-16T10:31:54Z

Walkthrough screenshots and recording, hosted on this PR so they render inline:

Empty form after Next — required errors on untouched fields, including email:

Create customer account shows the password field and Continue as guest:

Continue as guest hides the password field again:

Recording:

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Reviewed the starter checkout validation/guest-toggle work and the devStorefrontUrl update:

Registration still goes to Store API POST /account/register. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in. Client $validate() is UX — the backend remains the auth boundary.

Place order without a session only runs register and does not call createOrder.

Validation and API error text are Vue-interpolated (FormInputField, LayoutNotification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin, not attacker-controlled; Shopware allowlists sales-channel domains for storefrontUrl.

No dependency or lockfile changes, and no secret logging.

No prior security-review threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

Screenshots and the recording are attached on the pull request as GitHub user-attachments so they render inline, instead of living in the repository or as external links.

cursor · 2026-09-16T10:36:46Z

Walkthrough screenshots and recording, attached on this issue so they render inline:

Empty form after Next — required errors on untouched fields, including email:

Create customer account shows the password field and Continue as guest:

Continue as guest hides the password field again:

Recording:

checkout_untouched_validation_and_guest_toggle.mp4

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed d58f2ff after the latest synchronize. The only delta since the previous assessment is removing walkthrough PNG/MP4 files from the repo (they now live on GitHub issue attachments). Checkout code is unchanged.

Registration still goes to Store API POST /account/register. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in. Client $validate() is UX — the backend remains the auth boundary.

Place order without a session only runs register and does not call createOrder.

Validation and API error text are Vue-interpolated (FormInputField, LayoutNotification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin, not attacker-controlled; Shopware allowlists sales-channel domains for storefrontUrl.

No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head d58f2ffd (walkthrough media removed from .github/pr-assets/; checkout/register code unchanged from the prior assessment):

Registration still goes to Store API POST /account/register. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in. Client $validate() is UX — the backend remains the auth boundary.

Place order without a session only runs register and does not call createOrder.

Validation and API error text are Vue-interpolated (FormInputField, LayoutNotification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin, not attacker-controlled; Shopware allowlists sales-channel domains for storefrontUrl.

No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

Remove the extra Next button from one-page checkout. Confirm and place order now creates the guest session (Store API register with guest: true) and then calls checkout/order, instead of stopping after register.

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head 2353ba8b after the latest synchronize. The new delta combines guest/account register and place order into one Confirm action (saveCustomerDetails() → Store API POST /account/register, then createOrder() → POST /checkout/order). That restores intended guest checkout; it is not an authz bypass. createOrder still needs a Store API customer context, which register establishes, and canPlaceOrder plus the backend still require shipping/payment methods.

Registration still goes to Store API POST /account/register. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in. Client $validate() is UX — the backend remains the auth boundary.

Validation and API error text are Vue-interpolated (FormInputField, LayoutNotification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin, not attacker-controlled; Shopware allowlists sales-channel domains for storefrontUrl.

No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

Guest checkout still has to POST /account/register with guest: true before POST /checkout/order. Register was 400ing because devStorefrontUrl was not a Sales Channel domain, so place order never reached createOrder. getStorefrontUrl() now falls back to a domain from the current session context when the preferred URL is not listed.

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head a522cbba after the latest synchronize. The new delta is getStorefrontUrl() falling back to a sales-channel domain from session context when devStorefrontUrl / window.location.origin is not listed under Sales Channel → Domains.

That value is only sent as storefrontUrl on Store API POST /account/register and newsletter subscribe. The backend still allowlists it against configured domains, so a client-side fallback cannot point confirmation/recovery links at an arbitrary host.

Combined guest register then place order remains the intended Store API flow (guest: true then POST /checkout/order). createOrder still needs a customer context; canPlaceOrder plus the backend still require shipping/payment.

Client $validate() is UX. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in.

Validation and API error text are Vue-interpolated (FormInputField, Notification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin. No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

Validate both customer form groups and refresh shipping/payment without failing the whole place-order flow if one promise rejects.

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head 21772b02 after the latest synchronize. The new delta switches checkout validation and post-register shipping/payment refresh to Promise.allSettled.

$validate() is fail-closed: a rejected validation is treated as invalid and blocks place-order.

Shipping/payment refresh failures no longer abort saveCustomerDetails. Place-order is still gated by canPlaceOrder (selected shipping and payment) and Store API POST /checkout/order.

Combined guest register then place order remains the intended Store API flow (guest: true then POST /checkout/order). createOrder still needs a customer context.

getStorefrontUrl() is only sent as storefrontUrl on register/newsletter subscribe. The backend still allowlists it against configured sales-channel domains.

Client $validate() is UX. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in.

Validation and API error text are Vue-interpolated (FormInputField, Notification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin. No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

…-8ee9

cursor

Stale comment

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head ab3aaca9 after ready_for_review. The only new commit since the last review is a merge of main (Cart recipe docs already on the base). Checkout validation, guest register + place order, and getStorefrontUrl() fallback are unchanged.

Combined guest register then place order is the intended Store API flow (guest: true then POST /checkout/order). createOrder still needs a customer context; canPlaceOrder plus the backend still require shipping/payment.

$validate() via Promise.allSettled is fail-closed. Shipping/payment refresh failures do not skip those gates.

getStorefrontUrl() is only sent as storefrontUrl on register/newsletter subscribe. The backend still allowlists it against configured sales-channel domains.

Client $validate() is UX. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in.

Validation and API error text are Vue-interpolated (FormInputField, Notification); no v-html on these paths.

devStorefrontUrl is a compile-time Shopware demo origin. No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

cursor

Security review

No medium, high, or critical vulnerabilities in this change.

Re-reviewed head ab3aaca9 after the latest synchronize. The only delta since 21772b02 is a merge of main (Cart recipe docs from #2722). Checkout, register, and getStorefrontUrl are unchanged.

$validate() remains fail-closed: a rejected validation is treated as invalid and blocks place-order.
Shipping/payment refresh failures still do not abort saveCustomerDetails. Place-order is gated by canPlaceOrder (selected shipping and payment) and Store API POST /checkout/order.
Combined guest register then place order remains the intended Store API flow (guest: true then POST /checkout/order). createOrder still needs a customer context.
getStorefrontUrl() is only sent as storefrontUrl on register/newsletter subscribe. Session domains come from GET /context; the backend still allowlists the value against configured sales-channel domains.
Client $validate() is UX. Guest mode sends guest: true and an empty password; account mode sends the password only when the shopper opts in.
Validation and API error text are Vue-interpolated (FormInputField, Notification); no v-html on these paths.
devStorefrontUrl is a compile-time Shopware demo origin. No dependency or lockfile changes, and no secret logging.

No prior security-review finding threads to re-report. Slack summary was skipped (posting tool not configured).

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

Maciej D (mdanilowicz) · 2026-09-17T06:50:45Z

+    },
+    acceptedDataProtection: true,
+  });
+  await Promise.allSettled([getShippingMethods(), getPaymentMethods()]);


You have to add forceReload. Without this option data are not refreshed

Maciej D (mdanilowicz) · 2026-09-17T07:29:45Z

+  let customerReady = isUserSession.value;
  try {
+    if (!customerReady) {
+      await saveCustomerDetails();


If the place order fails, this function will block address editing,

useUser -> register

fix(vue-starter-template): validate checkout and restore guest orders

ee35515

Show client-side errors on submit even when fields were never focused, keep guest checkout as the default with a way back from create-account, and require zip/state before the register request is sent.

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 09:50 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 09:51 View deployment

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 09:52 View deployment

fix(vue-starter-template): use starter demo as devStorefrontUrl

d5e7173

Point registration storefrontUrl at https://frontends-starter-template.vercel.app instead of the deprecated demo-store domain.

vercel Bot temporarily deployed to Preview – old-frontends-demo September 16, 2026 10:27 Inactive

chore: mention starter demo storefront URL in the changeset

27791fa

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 10:28 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 10:29 View deployment

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 10:30 View deployment

docs: attach checkout walkthrough screenshots and recording

a54d4fc

Add the browser verification images and compressed recording so they can be shown inline on the pull request.

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 10:32 View deployment

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 10:32 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 10:32 View deployment

cursor Bot reviewed Sep 16, 2026

View reviewed changes

chore: host checkout walkthrough media on the GitHub issue

d58f2ff

Screenshots and the recording are attached on the pull request as GitHub user-attachments so they render inline, instead of living in the repository or as external links.

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 10:37 View deployment

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 10:37 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 10:37 View deployment

cursor Bot reviewed Sep 16, 2026

View reviewed changes

fix(vue-starter-template): place guest orders after register

2353ba8

Remove the extra Next button from one-page checkout. Confirm and place order now creates the guest session (Store API register with guest: true) and then calls checkout/order, instead of stopping after register.

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 10:43 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 10:45 View deployment

cursor Bot reviewed Sep 16, 2026

View reviewed changes

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 10:46 View deployment

vercel Bot deployed to Preview – old-frontends-demo September 16, 2026 12:30 View deployment

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 12:31 View deployment

cursor Bot reviewed Sep 16, 2026

View reviewed changes

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 12:32 View deployment

fix(vue-starter-template): use Promise.allSettled in checkout

21772b0

Validate both customer form groups and refresh shipping/payment without failing the whole place-order flow if one promise rejects.

vercel Bot temporarily deployed to Preview – old-frontends-demo September 16, 2026 16:31 Inactive

vercel Bot deployed to Preview – frontends-vue-starter-template September 16, 2026 16:33 View deployment

cursor Bot reviewed Sep 16, 2026

View reviewed changes

vercel Bot deployed to Preview – frontends-starter-template-extended September 16, 2026 16:34 View deployment

Patryk Tomczyk (patzick) self-assigned this Sep 16, 2026

Patryk Tomczyk (patzick) added the domain/framework For x-team workflows and tracking efforts label Sep 16, 2026

Patryk Tomczyk (patzick) marked this pull request as ready for review September 16, 2026 16:39

Merge branch 'main' into cursor/fix-starter-checkout-guest-validation…

ab3aaca

…-8ee9

vercel Bot temporarily deployed to Preview – frontends-vue-starter-template September 16, 2026 16:39 Inactive

vercel Bot temporarily deployed to Preview – old-frontends-demo September 16, 2026 16:39 Inactive

vercel Bot temporarily deployed to Preview – frontends-starter-template-extended September 16, 2026 16:39 Inactive

Patryk Tomczyk (patzick) requested review from Maciej D (mdanilowicz) and Maciek Kucmus (mkucmus) September 16, 2026 16:39

cursor Bot reviewed Sep 16, 2026

View reviewed changes

Maciej D (mdanilowicz) requested changes Sep 17, 2026

View reviewed changes

Uh oh!

Conversation

Patryk Tomczyk (patzick) commented Sep 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

ToDo's

Screenshots (if applicable)

Additional context

Uh oh!

vercel Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Sep 16, 2026

Uh oh!

cursor Bot commented Sep 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot commented Sep 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Security review

Uh oh!

Maciej D (mdanilowicz) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Maciej D (mdanilowicz) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Patryk Tomczyk (patzick) commented Sep 16, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Sep 16, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading