由 PayPal 从 IPN 端点中删除的 QueryString 值 [英] QueryString values removed from the IPN endpoint by PayPal

问题描述

我们已经与 PayPal 进行了简单的支付集成 5 年，直到今天一直没有问题.在 IPN URL (notify_url) 中，我们在查询字符串中传递 3 个值，例如

We've had a simple payment integration with PayPal for 5 years that has run without issue until today. In the IPN URL (notify_url) we pass 3 values in the querystring e.g.

https://www.example.com/callback/ipn?pspId=A&secCode=MnBP%2fxOwbQhXLd%2arD5xd6g%3d%3d&isPur=false

从今天起，PayPal 删除最后 2 个值并仅使用第一个查询字符串值调用，例如

From today PayPal strip the last 2 values and call with just the first querystring value, e.g.

https://www.example.com/callback/ipn?pspId=A

我们使用 secCode 值作为我们在回调中验证的签名，以防止对表单进行任何修改.为什么 PayPal 会突然开始从查询字符串中删除值?我怀疑他们应该在 POST 中，但我不确定为什么突然改变?

We use the secCode value as a signature that we verify on the callback to prevent any modification of the form. Why would PayPal suddenly start stripping out values from the querystring? I suspect they should be in the POST but I'm just not sure why the sudden change?

推荐答案

好的，我们现在已经意识到一些 PayPal 的服务器在第一个 & 符号处终止.这解释了为什么我们得到第一个查询字符串值而不是其他.

OK we have now realised that some of PayPal's servers are terminating at the first ampersand. This explains why we get the first query string value but not others.

似乎这种行为不仅限于 notify_url 值，而且正如 Mike 在评论中所建议的那样，这也发生在 CUSTOM 字段中.如果您通过与号分隔符推送一系列名称值对，您需要切换到其他分隔符或对整个值进行 URL 编码.

It seems this behaviour is not just limited to notify_url value but as is suggested by Mike in the comments, this is happening with the CUSTOM field too. If you're pushing through a series of name value pairs with an ampersand separator you need to either switch to some other separator or URL Encode the whole value.

我们现在正在测试 URL Encoding 整个回调 URL 是否仍会导致实际回调.

We're just now testing to see if URL Encoding the whole callback URL will still result in an actual callback being made.

是 URL 编码整个 notify_url 值解决了问题并保留了查询字符串.

Yes URL encoding the whole notify_url value resolved the issue and preserved the query string.

编辑 2:

似乎对整个值进行 URL 编码不再有效，因此我假设 PayPal 已恢复到我们遇到这些问题之前的原始行为.希望这将在所有入站服务器上保持一致，并且现在将保持固定.

It seems URL encoding the whole value no longer works, so I'm assuming PayPal have reverted back to the original behaviour before we encountered these problems. Hopefully this will be consistent across all their inbound servers and will remain fixed now.

这篇关于由 PayPal 从 IPN 端点中删除的 QueryString 值的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！