Many clients are reporting issues while paying with Vipps as they are getting 403 Access denied when returning back from Vipps payment (whether it's successful or cancelled payment). Order is kept locked and there's no way for client to resume it. This issue was reported upstream in #3051241: User is sent to 403 page after successful payment (anonymous checkout).

Basically Vipps forces #return_url on default browser rather than the browser initiating payment request. Cart is not attached to that browser's session as it was initiated from different browser or in-app browser.

CommentFileSizeAuthor
#7 3105358-7.patch10.84 KBzaporylie
#4 3105358-4.patch10.05 KBzaporylie
#3 3105358-3.patch10.66 KBzaporylie
#2 3105358-2.patch9.55 KBzaporylie
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

zaporylie created an issue. See original summary.

zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented
Status: Active » Needs review
FileSize
3105358-2.patch9.55 KB

The idea to mitigate this issue is to attach cart to the current session based on unique vipps auth key. Once used key expired. It also expires once user returns back from Vipps even if keeping same browser/session. All attempts to use incorrect key are logged with critical severity.

zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented
FileSize
3105358-3.patch10.66 KB
zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented
FileSize
3105358-4.patch10.05 KB

commerce_cart is tricky to use in tests (as per comment in CartManagerTestTrait::installCommerceCart()) so avoiding it for now by setting service as abstract if cart module is missing.

eiriksm’s picture

eiriksm
he/him
Primary language Norwegian Bokmål
Location Norway
CreditAttribution: eiriksm at Ny Media AS, Violinist commented

Do you have steps to reproduce this to test it out?

zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented

Steps to reproduce can be found in related issue #3051241: User is sent to 403 page after successful payment (anonymous checkout)

zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented
FileSize
3105358-7.patch10.84 KB

Added logging for each successful cart session attachment

  • zaporylie committed b7b54fa on 8.x-4.x 
    Issue #3105358 by zaporylie: Attach cart to session if user is on mobile...
zaporylie’s picture

zaporylie
he/him
Primary language Polish
CreditAttribution: zaporylie at Ny Media AS commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.