PayPal Subscription create_order_error / 400 VALIDATION_ERROR response - paypal

I've implemented the following code to accept subscriptions with PayPal's smart buttons. It was working correctly, but it has been showing an error message for the last couple of hours. No changes have been made to the code.
paypal.Buttons({
createSubscription: function(data, actions) {
return actions.subscription.create({
'plan_id': plan_id
});
},
onApprove: function(data, actions) {
//alert('You have successfully created subscription ' + data.subscriptionID);
}
}).render('#paypal-button-container');
The error message in the browser console is:
A boolean is being passed as a fourth parameter to window.open. This is not used and may cause an exception in a future release.
POST https://www.paypal.com/smart/api/billagmt/subscriptions/I-XXXXXXXXXXXX/cartid 400
create_order_error
Is anyone having the same issue?

400 validation error that looks like a PayPal issue, I think it will be rolled back. Try again in something like 4 hours or so and see if it's resolved.

Related

PayPal subscription payment is not working with sandbox

I have used the following code for PayPal subscribe button, from the sandbox.paypal.com:-
<div id="paypal-button-container-P-86B16126YE351481NMH6WMRY"></div>
<script src="https://www.paypal.com/sdk/js?client-id=AT4fx8CxfLze4ZzMRrp-yUZBlKQvFt97cMDgzUwqXBpbvPSw7w0EmoLBk1zJw7PddEDRD_HJ05y4qjh5&vault=true&intent=subscription" data-sdk-integration-source="button-factory"></script>
<script>
paypal.Buttons({
style: {
shape: 'pill',
color: 'silver',
layout: 'horizontal',
label: 'subscribe'
},
createSubscription: function (data, actions) {
return actions.subscription.create({
/* Creates the subscription */
plan_id: 'P-86B16126YE351481NMH6WMRY'
});
},
onApprove: function (data, actions) {
alert(data.subscriptionID); // You can add optional success message for the subscriber here
}
}).render('#paypal-button-container-P-86B16126YE351481NMH6WMRY'); // Renders the PayPal button
</script>
But, when clicking this button from the website (where I put this button code) and logging into the PayPal sandbox for the payment, it shows the following error message:-
Sorry, we couldn't set up your subscription using the payment method you selected. Please try another payment method.
I have tried all the available payment methods for my sandbox account(where from I am trying to subscribe). But nothing worked. I have been trying it for the last couple of hours, but it is not working.
Review your list of sandbox accounts, log into this button's account via www.sandbox.paypal.com and go to its email settings. Resend a confirmation "email" if necessary--sandbox doesn't send real email messages.
Read the confirmation "email" in the "Notifications" side tab of the developer dashboard, and use the link there to confirm it.
Retry your subscription payment after having confirmed the receiving sandbox account's primary email.

Are PayPal Smart Checkout Buttons vulnerable?

I am making an Ecommerce website which should allow Paypal payments, using Smart Checkout Buttons.
My worry is that everyone can Curl my website, getting the raw HTML+js page and edit the purchase unit values. Once they've done that they could run the webpage, the js code will be executed, the button gets rendered with fake values, and they could fake the payment (with less money).
Is that true? And are there any solutions still using the Smart Button (Without the REST API)?
I cannot create manually the buttons since there will be many articles which are sold by different users.
paypal.Buttons({
// Set up the transaction
createOrder: function(data, actions) {
var o = actions.order.create({
purchase_units: [{
amount: {
value: '30.99' //Can users change this ?
},
payee: {
email_address: 'sb-qloys3515897#business.example.com'//email of the sellers
}
}]
})
return o;
},
// Finalize the transaction
onApprove: function(data, actions) {
console.log(details);
return actions.order.capture().then(function(details) {
// Show a success message to the buyer
//alert('Transaction completed by ' + details.payer.name.given_name + '!');
alert(details);
});
}
}).render('#paypal-button-container');
If you use client-side code only then yes, anyone can edit that client side code right in their browser and pay you any amount they wish, from $0.01 to tens of thousands of dollars.
If this scenario concerns you, then a client-side only integration is obviously too simple for you, and you should instead implement one with your server that does the validation you desire.
Create two routes on your server, one for 'Set Up Transaction' and one for 'Capture Transaction', documented here.
Then have your PayPal button call those two routes; here is the best demo code: https://developer.paypal.com/demo/checkout/#/pattern/server

Can't approve PayPal subscription using smart buttons or subscriptions REST API

I'm trying to integrate PayPal subscriptions using Smart Buttons in JavaScript with sandbox app & account.
paypal.Buttons(
{
style: {
layout: 'horizontal',
size: 'small',
color: 'gold',
label: 'paypal',
height: 35,
tagline: 'true'
},
createSubscription: function (data, actions) {
return actions.subscription.create({
'plan_id': 'P-xxxxxxxxxxxxxxxxxxxxxxxx'
});
},
onApprove: function (data, actions) {
alert('You have successfully created subscription ' + data.subscriptionID);
}
}
).render('#paypal-button-container');
After new window opens up I login with my sandbox bussiness account. The spinner appears and after a while I get a message "Something went wrong". I checked webhook and subscription is successfully created, but when PayPal navigates to checkout to approve it, the above happens.
I tried to use Subscriptions API and I made a call using Postman to create subscription. Then in response I recieved url to approve subscription. I opened it, logged in, this time I had to choose PayPal or Credit/Debit Card and again, spinner, some time passes and message appears saying "Something went wrong."
I checked wether encryption settings are disabled, cause I found it might cause issues, but it was disabled by deafult.
I also tried passing the whole subscription object from docs, not just "plan_id", but it changed nothing.
Don't have any other ideas what might went wrong. I hope someone stumbled upon this issue, found the solution and is willing to share it :D

How to handle a PayPal Checkout payment when there is a confirmation API error on our server

We are integrating the PayPal client side Checkout Integration for taking payments on our website. This can be found here:
https://developer.paypal.com/docs/checkout/integrate/#6-verify-the-transaction
Once the payment has been made and approved by PayPal, we need to call our server to verify the transaction and store it within our database. This code can be found below, note the part "Call your server to save the transaction".
<script>
paypal.Buttons({
createOrder: function(data, actions) {
return actions.order.create({
purchase_units: [{
amount: {
value: '0.01'
}
}]
});
},
onApprove: function(data, actions) {
return actions.order.capture().then(function(details) {
alert('Transaction completed by ' + details.payer.name.given_name);
// Call your server to save the transaction
return fetch('/paypal-transaction-complete', {
method: 'post',
body: JSON.stringify({
orderID: data.orderID
})
});
});
}
}).render('#paypal-button-container');
</script>
Now, in the above instance, what happens if the call to "/paypal-transaction-complete" fails? session timeout or lost internet connection? For example, in the Stripe integration, the money is "approved" in on the client side and then only confirmed/charged in our API to "/stripe-transaction-complete". If there is an error, we don't actually charge the money.
Within PayPal, the money is charged before the API call, so the is the small possibility we charge the user but they don't receive the paid order in the database. How would we best handle this? one option would be to call the PayPal API and match all the orders with payments and then either auto-refund or auto-complete the order. But I'm not sure if this is recommended.
For both PayPal and similar issues with Stripe Checkout, this can be addressed using WebHooks.
https://developer.paypal.com/docs/integration/direct/webhooks/rest-webhooks/#

Include a message/note field in a PayPal API payment

I am building a really simple payment form where the user can enter an amount and a thank you message. I have got it successfully working with just the amount but I cannot get add a message field and get it to come through!
Here is just the payment function of my JavaScript:
payment: function(data, actions) {
return actions.payment.create({
payment: {
transactions: [
{
amount: {
total: window.transactionAmount,
currency: 'GBP'
},
note_to_payee: document.getElementById('custom-message').value,
description: 'A gift to Martin.',
custom: 'This is a test custom field',
payee: {
"email": "martin#[hidden].com"
}
}
]
},
experience: {
input_fields: {
no_shipping: 1,
allow_note: true
}
}
});
},
I have tried setting custom and note_to_payee but neither seem to be recorded on either the notification email or the data that is logged in the recipient's account.
I have also tried turning on the ability for the payer to add a note by setting allow_note: true in the experience config but that does nothing!
Please help, just any way of passing through a little message with the payment is all I need.
It took PayPal Support team 4 days to come back with the answer that No, it cannot be done.
Here's their full response:
With regard to your request, I have to inform you that "note to seller" (allow_note:true) field is only available in the older PayPal payment experience, and is not available in the newer payment experience.
Unfortunately, there's nothing the caller can do at this time to force an old or new experience and we recommend to collect this information in your website where possible.
So it looks like they've dropped one of the nicest and most simple features of the PayPal checkout which was the ability to include a friendly little note.
Now, my only option is to build a whole back-end system with API end-points and extend my JavaScript just to record my payer's note. Meanwhile, every email notification I receive will continue to contain that annoying lie: "The buyer hasn't entered any instructions".
PayPal: Please, either implement a feature in your new process or remove/hide the feature! Don't do a half-way job. You take 10% of all my transactions, I expect better.
A workaround for this would be to use an "option variable" to create a textbox in your checkout flow. An example of an option variable would be "os0" and "on0".
Here is an example on our website on how you would implement this: https://www.paypal.com/us/cgi-bin/webscr?cmd=_pdn_xclick_options_help_outside
https://developer.paypal.com/sdk/js/reference/#onapprove
paypal.Buttons({
createOrder: function(data, actions) {
...
},
onApprove: function(data, actions) {
// This function captures the funds from the transaction.
return actions.order.capture().then(function(details) {
// This function shows a transaction success message to your buyer
alert('Transaction ' + transaction.status + transaction.id);
window.location.href = 'https://www.yoursite.com/page.php?trnsid='+ transaction.id;
});
}
}).render('#paypal-button-container');
You can do a redirect onApprove.
If the transaction was completed redirect the user to a page with a FORM THAT GET/capture the transactionID (associate the message with a transaction) and ADD a MESSAGE TEXTAREA so user can send some notes after payment.