Post by josesoares » Thu Jul 13, 2023 12:27 am

Hi,
I am trying to implement a credit card payment extension.
The payment process is the following:
- the user confirms the order at checkout;
- the user is redirected to the credit card gateway page that has the card details form;
- the user fills the card details and confirms;
- the user is redirected by the payment gateway back to the store, either to a success page or a failure page (default of opencart);

The problem is that, on the very last step, when the user is back at the store success or failure page, he/she is no longer logged in.
I have read some other posts, but they seem to mention changing the core, which I can't.
The URL is correct because I do get redirected to the correct page.
I have also fiddled with login_token to see if maybe if I passed it as an argument, it would fix it, but that did nothing.

These are the URLs I am passing as arguments to the gateway, I have also tried using false for the javascript boolean...

Code: Select all

$successCallbackUrl = $this->url->link('extension/myPex/payment/ccard.callback', '', true);
$errorCallbackUrl = $this->url->link('extension/myPex/payment/ccard.callback', '', true);
$cancelCallbackUrl = $this->url->link('extension/myPex/payment/ccard.callback', '', true);
You may notice that the URLs point all to a callback function, this is because I am testing calling a controller and then redirecting from there, but I have also redirected successfully to the checkout/success and checkout/failure, although I still get logged out.

I appreciate all the help I can get :) and thanks in advance.
Last edited by josesoares on Fri Jul 14, 2023 3:17 pm, edited 2 times in total.

New member

Posts

Joined
Mon Jan 23, 2023 5:27 pm

Post by straightlight » Thu Jul 13, 2023 12:50 am

OC version. API documentation.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester


Legendary Member

Posts

Joined
Mon Nov 14, 2011 11:38 pm
Location - Canada, ON

Post by ADD Creative » Thu Jul 13, 2023 5:13 am

It would be helpful to post your OpenCart version and PHP version.

Assuming 4.x, how does you payment return back to your store? With a GET or a POST? What do you have the Session Samesite Cookie set to in your OpenCart settings?

www.add-creative.co.uk


Guru Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom

Post by josesoares » Thu Jul 13, 2023 4:24 pm

Sorry about the missing information.
It's Opencart version 4.0.2.1
PHP 8.1
The payment returns back by a GET request (I have assumed this, I am not sure)
and the Session Samesite Cookie is set to strict

As ADD Creative mentioned the samesite cookie, I went and changed it to lax, and I got it to complete the payment and return to the success page while remaining logged in.
I did read that LAX will only allow POST requests, which makes me think that maybe the gateway is redirecting using POST.

So now the question is, is this safe?
I mean, I am changing the samesite cookie settings for all of the Opencart instalation...

New member

Posts

Joined
Mon Jan 23, 2023 5:27 pm

Post by ADD Creative » Thu Jul 13, 2023 5:14 pm

If the customer is returned with a GET you will need to set at least Lax for the SameSite. Strict would would block the cookie.

If the customer is returned with a POST you will need to use None for the SameSite. Both Strict and Lax would block the cookie.

Strict offers the most protection and None the least. With Lax being the default.

www.add-creative.co.uk


Guru Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom

Post by josesoares » Thu Jul 13, 2023 5:40 pm

Thanks for the info, for some reason my opencart installation had strict set by default.
I will add the "set samesite cookie to Lax" as a requirement for enabling the extension in my extension usage manual.

Thank you for all the help. :)

New member

Posts

Joined
Mon Jan 23, 2023 5:27 pm

Post by ADD Creative » Thu Jul 13, 2023 7:57 pm

Just to clarify. It's web browsers that will default to Lax if the SameSite attribute is set at all. The default in OpenCart does look to be set to Strict.

https://github.com/opencart/opencart/bl ... .sql#L1978

www.add-creative.co.uk


Guru Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom

Post by josesoares » Thu Jul 13, 2023 11:49 pm

oh ok, thank you for that, I will take that into account

New member

Posts

Joined
Mon Jan 23, 2023 5:27 pm

Post by straightlight » Thu Jul 13, 2023 11:53 pm

Now that the issue has been resolved, please add: [SOLVED] at the beginning of the subject line on your first post.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester


Legendary Member

Posts

Joined
Mon Nov 14, 2011 11:38 pm
Location - Canada, ON
Who is online

Users browsing this forum: No registered users and 1 guest