Live Paypal Error

Question

I use PayPal in ASP.net and when I tested in sandbox everything was correct, but when I use the live part I'm getting this error:

This payment cannot be completed and your account has not been charged. Please contact your merchant for more information. We are not able to process your payment using your PayPal account at this time. Please return to the merchant's website and try using a different payment method (if available).

this is my webconfig

 <add key="token" value="*************************"/>
  <add key="paypalemail" value="*************@gmail.com"/>
  <add key="PayPalSubmitUrl" value="https://www.paypal.com/cgi-bin/webscr"/>
  <add key="FailedURL" value="http://www.stockholmsbygg.net/Failed.aspx"/>
  <add key="SuccessURL" value="http://www.stockholmsbygg.net/FindOpenRequests.aspx"/>
  <add key="Notification" value="http://www.stockholmsbygg.net/Notification.aspx"/>

and redirect to Paypal

   public static string RedirectToPaypal(string invoiceNumber, string requestId, string userId, string customId, string itemName, string amount)
        {

            string redirecturl = "";
            redirecturl += "https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=" + ConfigurationManager.AppSettings["paypalemail"].ToString();
            redirecturl += "&first_name=" + userId;
            redirecturl += "&item_name=" + itemName;
            redirecturl += "&amount=5.00";
            redirecturl += "&quantity=1";
            redirecturl += "&currency=SEK";
            redirecturl += "&invoice=" + invoiceNumber;
            redirecturl += "&custom=" + requestId;
            redirecturl += "&on0=" + HttpContext.Current.Request.UserHostAddress;
            redirecturl += "&return=" + ConfigurationManager.AppSettings["SuccessURL"].ToString() + "?Type=ShowDetail";
            redirecturl += "&cancel_return=" + ConfigurationManager.AppSettings["FailedURL"].ToString();
            redirecturl += "&notify_url=" + ConfigurationManager.AppSettings["Notification"].ToString();
            return redirecturl;
        }

and this is everything that I check after returning from paypal to my address

if (Request.QueryString["cm"] != null)
                        {

                             const string authToken = "*********************************";
                             string txToken = Request.QueryString["tx"];
                             string query = "cmd=_notify-synch&tx=" + txToken + "&at=" + authToken;

                             //const string strSandbox = "https://www.sandbox.paypal.com/cgi-bin/webscr";
                           string strSandbox = "https://www.paypal.com/cgi-bin/webscr";
                             var req = (HttpWebRequest)WebRequest.Create(strSandbox);

                            req.Method = "POST";
                            req.ContentType = "application/x-www-form-urlencoded";
                             req.ContentLength = query.Length;


                             var streamOut = new StreamWriter(req.GetRequestStream(), System.Text.Encoding.ASCII);
                           streamOut.Write(query);
                           streamOut.Close();
                           var streamIn = new StreamReader(req.GetResponse().GetResponseStream());
                           string strResponse = streamIn.ReadToEnd();
                             streamIn.Close();

                             var results = new Dictionary<string, string>();
                             if (strResponse != "")
                             {
                                 var reader = new StringReader(strResponse);
                                 string line = reader.ReadLine();

                                 if (line == "SUCCESS")
                                 {

                                     while ((line = reader.ReadLine()) != null)
                                     {
                                         results.Add(line.Split('=')[0], line.Split('=')[1]);

                                     }
                                     var userId = Convert.ToInt64(Session["UserID"]);
                                     var item = Convert.ToInt64(Request.QueryString["cm"]);
                                     context = new entities();
                                     var existUser = context.Payments.Where(u => u.UserID == userId).ToList();
                                     var existItem = existUser.Where(i => i.RequestID == item).ToList();
                                     var paypalInvoice = results["invoice"];
                                     var txn_id = results["txn_id"];
                                     var sameInvoice =
                                         existItem.Where(i => i.invoice== paypalInvoice).FirstOrDefault();
                                     if (sameInvoice != null)
                                     {
                                         var currentAmount = Request.QueryString["amt"];
                                         var dbAmount = Convert.ToDecimal(sameInvoice.Amount).ToString();
                                         var currentIp = HttpContext.Current.Request.UserHostAddress;

                                         if (dbAmount != null)
                                         {
                                             if (currentAmount == dbAmount)
                                             {

                                                 if (currentIp == sameInvoice.IP)
                                                 {

                                                     sameInvoice.Status = true;
                                                     sameInvoice.PaypalTX = txn_id;
                                                     pnlSearch.Visible = false;
                                                     pnlShowDetail.Visible = true;
                                                     ShowDetail(Request.QueryString["cm"], true);
                                                     btnBack.Visible = false;
                                                     PrivateDetail.Visible = true;
                                                     interested.Visible = false;
                                                     context.SaveChanges();
                                                 }

                                             }
                                         }


                                     }

                                 }
                                 else if (line == "FAIL")
                                 {
                                     // Log for manual investigation
                                     Response.Write("Unable to retrive transaction detail");
                                 }
                             }
                             else
                             {
                                //unknown error
                                 Response.Write("ERROR");
                             }
                         }

What is the problem? Also at the first time when testing I paid money but nothing happened. Invoice status wad still false while it should have turned to true since I paid!

Answer 1

This function is an error 100% RedirectToPaypal()

There is no redirect to paypal. There is only post to that address with post parameters, not get (redirect).

And this is logical because if you place all that sensitive data on the url, then is exposed to anyone that is ether proxy in the middle ether anything that keep the url with all that data.

For me if you make a redirect with that data, and not post, the paypal is not found anything about the account, because there are no post data, and thats why you get that error.