Using Paypal IPN with website running on localhost - paypal

Question

I want to integrate Paypal Instant Payment Notifications (Paypal IPN) into my ASP.NET website. The website is in development mode and it runs on localhost.
Following this tutorial (https://developer.paypal.com/docs/classic/ipn/integration-guide/IPNTesting/#local) I created a script that simulates a IPN notification. This IPN notification hits the IPN handler of my website.
However, when my IPN handler reposts the information back to Paypal sandbox, Paypal always returns INVALID. I guess this is expected because Paypal did not send the original IPN message.
However, I want to test the code that will run when IPN message is verified by Paypal. Currently I have no way to do it. Paypal docs say that I should put the code that runs when message is verified into the block that runs when message is invalid.
That is
if(response == "VERIFIED")
{
//put any code here in the else if block below
}
else if(response == "INVALID")
{
}
This technique appears very unclean and incomplete to me. I will have to change my code when I deploy to live server.
Is there a better way to test IPN using localhost?

Answer 1

There is a great tool for this: https://ngrok.com/.
Ngrok allows "secure intospected tunnels into localhost". Basically you deploy ngrok, and then a URL like '48210d19.ngrok.com' will point to your localhost. You use that URL for testing your IPNs.

Answer 2

That snippet you've shown is the correct way to do it. I'm not sure why you would think you have to change anything when you go live..??
What I like to do is just set a $verified parameter within that to true/false accordingly.
if(response == "VERIFIED")
{
$verified = true;
}
else if(response == "INVALID")
{
$verified = false;
}
From that point on in your script you can use if($verified) to handle certain tasks. Any code that you want to happen when a successful call takes place should go inside verified code blocks, and any code you want to run if it's not verified should go inside else blocks, or maybe a if(!$verified) block.
I typically just do the same thing for all IPN's, but I have a field in my database to store the status of the IPN. That way in my own reporting or web apps I can easily separate the verified and unverified data, and processing them however I want to.
As the docs say, when you're testing with a local form like that, the data is not coming from PayPal so those will always be unverified. If you want to fully test actual data from PayPal you can do that in the sandbox, too, using the IPN Simulator available in your PayPal developer account or by setting up IPN in your sandbox seller account and actually processing a payment.
Of course, you'll need to make sure your IPN script is configured to handle both sandbox and live transactions, but assuming it is you would get a verified IPN in those tests since the data actually did come from PayPal's sandbox server.

Answer 3

If your development environment uses Vagrant, then it takes only a few simple steps to use vagrant sharing which makes your vagrant virtual accessible publically (i.e. temporarily, for demo purposes, etc.), and allows PayPal to send IPNs to your dev site.
Sign up for a free Atlas account at https://atlas.hashicorp.com.
Log in as follows:
(trunk)jason#canoe:~/my/project$ vagrant share
(you will be prompted for email & password)
Start sharing:
(trunk)jason#canoe:~/my/project$ vagrant share
==> default: Detecting network information for machine...
default: Local machine address: 192.168.22.10
default: Local HTTP port: 80
default: Local HTTPS port: disabled
==> default: Checking authentication and authorization...
==> default: Creating Vagrant Share session...
default: Share will be at: delinquent-puppy-5196
==> default: Your Vagrant Share is running! Name: delinquent-puppy- 5196
==> default: URL: http://delinquent-puppy-5196.vagrantshare.com
You need to take care to set your IPN url (notify_url variable in your paypal form) to the HTTP HOST header passed from the browser. How you get this header depends on your framework; it is often callend SERVER_NAME or HOST_NAME.