CiviCRM assumes PayPal Standard redirects back, that it will preserve the session cookies. But sometimes it doesn't and this causes CiviCRM to fail, even though PayPal has successfully processed the payment.
To reproduce ...
- My environment is: Ubuntu 20.04, CiviCRM 5.28.4 plus security patches, Chrome Beta 90.0.4430.30
- Use Chrome browser
- Ensure you are logged out of PayPal
- Makes a note of the SESS* and SSESS* cookies
- Make a donation with PayPal Standard. During this process, log into PayPal and complete the payment.
- When redirected back to CiviCRM, the response is "Could not find a valid session key" and the SESS* and SSESS* cookies have been regenerated
The issue is that the SESS* and SSESS* cookies are missing when PayPal redirects back to CiviCRM.
Here's how I fixed the problem ...
- Implement a Fatal Error Handler for CiviCRM to catch the error
- Detect that we 'Could not find a valid session key' when redirected back from paypal.com to the ThankYou page
- Find the row in the sessions table that can reproduce the qfKey for this transaction
- If found, load that session data into this session and redirect with a 307 response code to get the user's browser to replay the POST request