Session information is getting destroyed after payment gateway posting
By Sarath
I am having a strange issue in one of my website. The session is getting destroyed (not everytime, randomly) when a callback is received from a payment gateway. Following is my code located at .../views/default/resources/payments/cancel.php
Any idea why this is happening? As a temporary fix, i added a login check to forward the user accordingly, but that's not the right solution.
$guid = elgg_extract('guid', $vars, null);
if($guid){
$error['failed_step'] = "rp_payment_canceled";
$error['failure_message'] = "payment:cancelled";
$error['failed_time'] = time();
$forwardURL = elgg_call(ELGG_IGNORE_ACCESS, function() use ($guid, $error) {
$entity = get_entity($guid);
$entity->payment_error = json_encode($error);
$entity->save();
$container = $entity->getContainerEntity();
if(elgg_is_logged_in()){
$url = $container->getURL();
}
return $url ?? elgg_get_site_url();
});
}
register_error(elgg_echo("payment:cancelled"));
forward($forwardURL);
Elgg Technical Support
Get support from other Elgg users
- Sarath@sarathsince85
Sarath - 0 likes
- https://webmasters.stackexchange.com/a/128680
- https://www.chromium.org/updates/same-site/faq
- Jeroen Dalsem@jdalsem
Jeroen Dalsem - 0 likes
- Sarath@sarathsince85
Sarath - 0 likes
- User logs in to elgg website (normal user login)
- Logged in user clicking on the "Proceed to payment" button (within elgg site)
- This will submit the form to the payment gateway website, with a hidden callback url parameter (which is a url in elgg website)
- Once payment is processed / cancelled, payment gateway sends the userback to the callback url (in the same browser); but randomly the users cookie is getting changed and user is now logged out of the system.
You must log in to post replies.Is this something related with?
You are saying your session is 'destroyed'. I think you should investigate if this is truly the case. You need to confirm if your session cookie is still available. If so, could there be a reason that the session is 'removed'? Sessions (and also the session cookie) have a limited lifetime.
There might also be another reason that the session is 'reset'. You can check that by looking at the identifier in the session cookie. If that changes, something reset the session. This normally only happens when a user logs in/out.
Be aware that session data is not copied from a logged out user to a logged in user. So if you have done something in your session as a logged out user and that user logs in, he/she loses the session data (as a new session is generated on login). If you need logged out user session data transferred to the logged in user, you need to copy this somewhere in your code.
Hi Jeroen,
This is not a login / logout issue. This is exactly how it happens
This is the exact problem they mentioned in the stackexchange webmaster link. Is this related with the same-site issue?