Search code examples
ruby-on-railspaypalpaypal-ipnpaypal-adaptive-payments

Paypal adaptive payments IPN callback: how to return the complete unaltered ipn message

I'm working on a marketplace (buyers and sellers) and the middleman gets a cut of every purchase. I want to enable the buyer to buy the item right after the buy button being redirected to Paypal. This is good and working.

response = ADAPTIVE_GATEWAY.setup_purchase(
  :return_url => 'return_url',
  :cancel_url => 'cancel_url',
  :ipn_notification_url => 'ipn_notification_url',
  :receiver_list => recipients,
)
# ADAPTIVE_GATEWAY.set_payment_options(...)
redirect_to (ADAPTIVE_GATEWAY.redirect_url_for(response['payKey']))

Next step is to validate the transaction with ipn. I do receive the paypal callback, but I'm unclear what should be returned?

def notify_cb
  notify = ActiveMerchant::Billing::Integrations::PaypalAdaptivePayment::Notification.new(request.raw_post)

  if notify.acknowledge
    update_attributes({
      :transaction_id => notify.transaction_id,
      :status => notify.status
    })
  end

  render :nothing => true # render nothing?!? RENDER_LINE
end

Most of the examples here on SO render nothing (RENDER_LINE), while on paypal documentation the flow is described as ( https://www.x.com/developers/paypal/documentation-tools/ipn/integration-guide/IPNIntro#protocol_and_arch ):

The IPN protocol consists of three steps:

  1. PayPal sends your IPN listener a message that notifies you of the event

  2. Your listener sends the complete unaltered message back to PayPal; the message must contain the same fields in the same order and be encoded in the same way as the original message

  3. PayPal sends a single word back, which is either VERIFIED if the message originated with PayPal or INVALID if there is any discrepancy with what was originally sent

My question would be how to return the complete unaltered message back to PayPal or i'm missing/being wrong with my understanding of the flow?

Solution

  • Are you posting back to https://sandbox.paypal.com/ or https://www.sandbox.paypal.com/cgi-bin/webscr (either include “cmd=_notify-validate as part of your POST data, or include via GET)?

    The former returns a HTTP 301 because you’re basically pointing directly to the homepage, whereas the latter will point directly to the page hosting the IPN validation logic.