#Village_Admin-checkout-successurl

1 messages · Page 1 of 1 (latest)

woven quest
#

that way, you can fetch the CheckoutSession ID on your server to get the real state of it

vocal jay
#

So is there a possibility of the user being sent to the landing page before all of the API hooks have happened?

woven quest
#

yes that is possible.

vocal jay
#

Is the {CHECKOUT_SESSION_ID} the only available variable to be passed in success_url?

woven quest
#

yes

#

OOC what other fields would you have wanted there

vocal jay
#

Nothing in mind, just seeing if anything was available i might be able to utilize to avoid another API lookup. Also not sure if i can use the {CHECKOUT_SESSION_ID} because the landing page has to be .html that redirects to .php and im not sure if i can capture and relay the var with html.

#

When i allow a redirect from stripe to .php it kills the users session.

#

So i have to bounce off html so the PHP is getting a refer from the same domain.

woven quest
#

not the most informed web-dev here but can't your HTML redirect to your php file and also pass data?

also not a PHP dev but looks like you can as part of $_SESSION ?

vocal jay
#

The issue is with sessions, for protection, the browser itself (outside of my control) will kill the cookie holding the session ID if the page is being linked/loaded from another page (the refer) that is cross domain.

#

You know to keep hackers from injecting some kind of hijack, man in the middle stuff, if it detects session cookie being requested from a page that isnt the same domain.

#

So when the users browser goes from stripe.com to my site, cross domain, the session cookie gets killed by the browser.

#

anyways, thanks, so i have the session ID i can try to use.

woven quest
#

but when you are redirected to your success page, then you have access to the CheckoutSession ID again right? you could use some custom JS to put that into the session just before redirecting to your php page?

vocal jay
#

Im not sure, i have to look it up. I have never captured a url?key=value before using pure html/js.

#

If js has access to the ?key=value then sure no problem.

woven quest