Guys I have a situation where I send a user off to a third party site to complete a transaction.
This third party site then pings a url on my site, allowing me to wrap things up on my end.
Problem is that I want to manipulate the users session in the ping script, however the session is blank as the user is still off the site on the third party site. When I call:
session_start() its starting a fresh session.
I understand that in order to get the session back I have to set session_id().
This is not a problem, however this will require sending the session_id() to the third party site, and I am concerned about how secure it will be to POST the session_id() off like this?
I guess I could encrypt the hell out of it, but i’m guessing that this is probably a bad idea.
Can anyone think of another workaround?
Thanks in advance...
-
MODX Staff
- 10,725 Posts
You should be able to pass a unique token representing the transaction to the third party site as part of the return url. You should store the transaction data with that key somewhere and be able to process the transaction if the return url is hit, regardless of sessions. The third party site when pinging URL should never be able to access the session of the user that submitted the transaction, so you’ll need to store this outside the session. Besides, if the user waits too long to complete the transaction and their session times out before the return url is hit, you will have lost the transaction details and still charged them for it. I’ve experienced problems on actual online stores that use third party payment systems like this when my session timed out and had to call them once to get my order submitted and a second time when the original transaction came through (apparently during a scheduled or manual reconciliation process).
thanks for the reply opengeek.
- The session does not have any critical data in relating to the transaction, what I simply want to do is kill the users session (thus clearing their cart) then they return from the merchant. I pass all the data I need to log the order, the ping url simple displays the appropriate message.
I hear you about the third party site, passing the ID along to give session access is probably not the way to go.
I guess I could write a snippet that does a simple referrer check. If the referrer is the merchant page, clear the session vars? I could just drop this into the top of my templates.
This might be a better approach?
