Paypal with option useraction=commit not creating transaction - symfony

i installed ezsystems/payment-paypal-bundle on ibexa commerce as a payment provider with all config and useraction=commit. so the Customer logs in from Paypal and clicks on the Pay Now button. Paypal gives no error, everything seems to be successful and customer is redirected at the RETURNURL, but no transaction is created in the buyer or in the seller account.

You are expected to show a review page on return, and run DoExpressCheckoutPayment (or equivalent) after the payer confirms the payment on your site. Setting useraction=commit will change the verbiage of the last button to say "Pay Now" instead of "Continue", indicating to the user that you are going to capture immediately (skipping the default review step) but this is only a wording change -- you still need to do a DoExpressCheckoutPayment (or newer API order capture/execution) to get a success orfailure response, and show the result.
It's worth noting that SetExpressCheckout / DoExpressCheckout payment are very old APIs....
The current v2/checkout/orders REST API does have similar capabilities if doing a redirect integration, but such redirecting is an old flow/ Keeping your site loaded and using JS for the approval instead of a redirect is always recommended nowadays (works with both current and old APIs).

Related

Silent payment using paypal without redirecting to paypal url

Is there a way I can pass the sellers credentials to the Paypal API and it can make a transaction without taking him to Paypal URL?
TL. DR.
I am trying to build an eCommerce website for a shop with Paypal as the payment medium. The payment for user has been implemented where he is redirected to the Paypal website and he can purchase an item. But under certain conditions he is allowed to cancel his purchase and his payment must be credited back to him.
I need this transaction to happen without navigating to the Paypal URL.The reason is that, the buyer is the one initiating the transaction. So there is no way he can authorize a transfer from sellers to buyers account. The buyer should be able to press the "Cancel Order" button and the payment should be immediately credited back to his paypal account.
I can store the sellers credentials in the server and send it to the API which should be able to authorize him but I was looking for an API which Paypal provides to make this happen.
My requirement is different from the anser provided in this question as here they still show a popup of paypal webpage.

Using IPN to verify successful payment on PayPal

I'm using PayPal hosted pages for payments on my site. I pass return url when creating SECURETOKEN used in iframe url. After client successful payment, I get browser postback from PayPal on return url passed when SECURETOKEN was created. What happens from time to time is that user close tab before I get postback, saying transaction is approved, and I can't mark it as approved in my local DB.
Workaround was to create IPN listener, and update my local records when I receive valid IPN request.
Now the issue is, I miss some params that I'm getting in iframe postback, that are mandatory, such as ACC, EXPTIME, PNREF.
As far as I can read, IPN will NEVER send those data in it's request. Can this be overridden within paypal manager? If not, can anyone suggest any solution to this problem?
Thanks
I managed to do this by enabling Silent POST url feature in my paypal manager, so same server to server postback will be fired regardless of client closing browser, after payment is accepted.

PayPal asynchronous notification

Now information about the successful transaction I get with a redirect the user back to my site from paypal. And then I make additional requests to api paypal.
But if the user cancels the redirect to my site, for some reason, I do not get the information about the transaction.
Is there an asynchronous notification from Paypal for Website Payments Standard or Express Checkout?
Instant Payment Notification (IPN) works for all payment methods through PayPal. The Developer.PayPal.com document you linked is a list of variables for the Express Checkout feature and it is telling you that you can only pass the NOTIFYURL variable successfully in the DoExpressCheckoutPayment API call.
In Payments Standard transactions you'll use the notify_url variable.
You can also just enable IPN within your account to have an IPN post sent to your notification page when any payment completes - regardless of whether or not you define a URL in the button code or API request (the URL you define in the code will always override what is set in your account).

Paypal integration without IPN

I want to integrate paypal buy now button and get feedback from paypal in a school project, but i don't want to use IPN because the computer running the website will not be accessible from outside.
Are there any options for doing this?
You don't have to enable IPN to have buy now buttons on Paypal, it's completely optional. The buy now button will still take you to the correct page on Paypal so the purchase can be made. IPN only allows you to get feedback from Paypal when this happens.
Well, I need to get some information
when a successful payment is made.
Paypal can notify you by mail when something has happened.
Apologies for the bump. Just adding this in case anyone else needs it:
Use "rm=2". (input type hidden, name=rm, value=2)
https://merchant.paypal.com/us/cgi-bin/?cmd=_render-content&content_ID=developer/e_howto_html_Appx_websitestandard_htmlvariables
Return method. The FORM METHOD used to send data to the URL specified by the return variable after payment completion. Allowable values:
0 – all shopping cart transactions use the GET method
1 – the payer’s browser is redirected to the return URL by the GET method, and no transaction variables are sent
2 – the payer’s browser is redirected to the return URL by the POST method, and all transaction variables are also posted

Preventing Spoofing with Paypal

I have a scenario where i need to have a user checkout through PayPal and then once we receive the payment then we create a membership record in our membership site. The PayPal requires a "return" field when you submit the form button that will take the user back to our page once the order has been successfully processed. On that page is where we actually track the sale and fire a chunk of javascript to track the sale.
So my question is this, how can i make sure that the return page comes from PayPal and is not spoofed by a user in the system. I know there is a way to use the notify_url to have PayPal post back to our system, but in this case i have to run a chunk of javascript. Is there an easy way to do this, or would i have to write some looping/timeout function that checks to see if the notify post has come through?
Im using .net to do the posting to paypal
You need to have PayPal call a script on your site in order to prevent spoofing. Anything that goes through the client/browser is open to the user for modification, so only things that come directly to your server from PayPal are secure.

Resources