CODEWITHSUNDEEP
paypal
jdhildeb
jdhildeb

Reputation: 3821

Did paypal change meaning of cancel url? Or is it a bug?

I maintain a PayPal integration which uses PayPal HTML Buttons and confirms payment using IPNs. This system has been in production for more than 5 years.

The system sets the cancel_return variable to a unique URL for each order. If this URL gets hit (i.e. if the customer cancels at paypal and gets sent to this URL), it first checks the session, to ensure the user hitting the URL is the same one who initiated the order, then cancels the order.

I noticed that several recent transactions have been cancelled even though the transactions at PayPal were successful.

The logs showed that customers are hitting the cancel_return URL - in some cases just after the IPN has been received, and in one case just before the IPN was received.

I found at least one way to reproduce this behaviour:

I then get a message that says "Your payment was completed. To continue shopping, please return to the merchant." One button is provided: "Return to merchant name".

Clicking this button takes the user to the cancel_return URL!!

PayPal's documentation for cancel_return says

A URL to which PayPal redirects the buyers' browsers if they cancel checkout before completing their payments. For example, specify a URL on your website that displays a "Payment Canceled" page. Default — PayPal redirects the browser to a PayPal webpage.

My question is whether this is an intentional change by PayPal -- if so I expect it will break many sites -- or if this is a bug. I couldn't find a bug report at PayPal.

Screenshot showing button

Upvotes: 4

Views: 1908

Answers (2)

jdhildeb
jdhildeb

Reputation: 3821

Yes, they changed the meaning of cancel_url, though they are not acknowledging this as a bug or an intentional change. This is definitely a bug in my opinion (as documented in the question above).

In addition to the steps above (reproducing using the back button), I found a customer click-trail in my server logs where the customer was sent to the cancel_url, without using the back button, soon after PayPal sent the IPN confirming their successful payment. I confirmed that the customer did not want to cancel and did nothing to intentionally cancel their order. Unfortunately I could not find a way to reproduce.

I registered at www.paypal-techsupport.com and submitted a ticket about this issue. After several exchanges, the end result I got was:

This is the information that I received from our engineer. Its an expected behavior when the customer click on the back button, it will bring back to the cancel_url.

We would suggest you to do some modification so that the order is not being cancel when the customer go to the cancel_url.

With poor customer support like this, I will not be recommending PayPal to any of my clients in the future.

Upvotes: 2

Ciaran Keogh
Ciaran Keogh

Reputation: 1

You can post it here and the PayPal folks can pick it up..... https://www.paypal-community.com/t5/Merchant-Technical-Support/ct-p/mts

Upvotes: 0

Related Questions