The call from your payment provider won't have any session cookie if it is direct from them to your site. Therefore it has nothing to do with your user session. You must give them some form of transaction number so that you know what the message is about when you receive it.
Missing session data
In my laravel application, I have a route that generates a payment link to an external payment provider and saves the reference to an order in a session. Then I get redirected to the external payment provider. Let's call this step one.
When I complete the payment or cancel, the payment provider returns a post request to another route. Let's call this step two.
When I return from the payment provider to that route, I lose my session temporarily. What I mean with that is, when I check the session data from the post request, it's a new session with a new session id. But, if I go up to the url, and make a get request to the same url, I get the session id I had in the first step with the session data intact.
Also, I only lose the session data if it's a post request from an external site, if it's from the same it's all fine. What's going on here? What am I missing?
The route is defined with any in the web.php, so it can recieve both post and get requests. The route is also added to the VerifyCsrfToken middleware to prevent error with csrf token when the external payment gateway makes the post request.
Step 2 with get request:
"Tf2uaMfV8XCDmLNgQH7VegUEiXwyG0En5jhswy4G"
array:5 [▼
"_token" => "j47Kv2pm1LhxwvIGP1OSt8wIjPA7YxtgBEfqMP2v"
"_flash" => array:2 [▶]
"_previous" => array:1 [▶]
"booking_id" => 34
"payment" => array:2 [▼
"number" => "4036434"
"url" => "https://paymentgatewayurl.com"
]
]
Step 2 with post request from external payment provider:
"0mvgc7tXpXdcFyKny6WXdUX06AJifcfAiMvAq0NT"
array:1 [▼
"_token" => "0rPrbkOdtW8Q0tDRIApG2BInsbU8pmPrw8BzxbWb"
]
After that, if I check again with a get request:
"Tf2uaMfV8XCDmLNgQH7VegUEiXwyG0En5jhswy4G"
array:5 [▼
"_token" => "j47Kv2pm1LhxwvIGP1OSt8wIjPA7YxtgBEfqMP2v"
"_flash" => array:2 [▶]
"_previous" => array:1 [▶]
"booking_id" => 34
"payment" => array:2 [▼
"number" => "4036434"
"url" => "https://paymentgatewayurl.com"
]
]
The function in the controller that generates the output from the above is:
public function checkout(Request $request)
{
dd($request->session()->getId(),$request->session()->all());
}
Any help is appreciated!
After upgrading, did any configuration change. Also see https://stackoverflow.com/questions/67692358/losing-session-data-after-post-from-third-party-website Just suggestion.
Edit: But the above via a transaction number returned is the safest way.
Please or to participate in this conversation.