dimaportenko/mma-customapi

Silent Redirect returnurl - Invalid Form Key

Closed this issue · 7 comments

0xMatt commented

The silent redirect return URL seems to fail, resulting in no 'PayPal PayflowPro response:' to appear in the debug logs.

Calling the input with a GET request works, but doesn't capture the query parameters:

  'PayPal PayflowPro response:' => 
  array (
  ),
) [] []

Is there a way for this endpoint to bypass csrf validation?

dimaportenko commented

hi @0xMatt
What endpoint are you talking about? And what are trying to do?

0xMatt commented

Sorry, the endpoint in question is /mma/transparent/response/?quoteId=:quoteId - Currently, it is not able to accept a POST request. Magento is intercepting and throwing an 'invalid form key error'. I am trying to capture the transparent redirect response data.

dimaportenko commented

yes, I think I used GET response instead.

0xMatt commented

GET response shows the empty payload as I described above.

The code also seems to expect POST, no? https://github.com/troublediehard/mma-customapi/blob/master/Controller/Transparent/Response.php#L118

dimaportenko commented

Actually, it was a while ago and I don't really remember how I used it. From what I can see now, I'm loading https://payflowlink.paypal.com with params from rest API /V1/mma/paypal/transparent/securityToken/${quoteId} and cart data in the mobile WebView. And the response is coming from the PayPal server. Not sure if it is POST or GET, but I think it could be configured somewhere in PayPal account.

0xMatt commented

I overrode the controller and implemented the interfaces CsrfAwareActionInterface, HttpPostActionInterface which resolved my issue. Thanks!

dimaportenko commented

Glad you solved your issue 🎉