The scenario happens when users placing orders on my site and use a third party payment method. They would go to the third party site and complete the payment (via POST request form submission). If the user submission (POST request) is correct, the third party site would return 302 redirect to my callback page. Here is what the issue begins. I have session (a cookie named foo) set to http only and no same site or secure setting. The user obviously has a session before he goes into the third party site to pay, but when he return, the POST request to my callback page has no cookie header. What is the underlining rule here and how can I ensure the user keeping his or her cookies?
Add a comment
|