PayPal Express checkout: callback error 400 about commerce-paypal HOT 6 CLOSED

Can you disable CSRF protection on Craft and see if that fixes your issue? It's mentioned only in Stripe gateway docs (https://github.com/craftcms/commerce-stripe#disabling-csrf-for-webhooks), but I suppose we should mention it for all gateways that complete payment via a callback.

from commerce-paypal.

Wouldn't it be nice to add this to the plugin itself?

class PluginController extends Controller
{
    // Disable CSRF validation for the entire controller 
    public $enableCsrfValidation = false;

    ...

In addition, it should at least be mentioned in the setup instructions of the plugin. It took me some time to find this post.

from commerce-paypal.

Closing due to inactivity.

from commerce-paypal.

I'm sorry for not replying - adding the callback action to the CSRF-disabling code indeed fixed this issue... FYI

from commerce-paypal.

For more information as to why CSRF must be disabled for PayPal routes: https://docs.craftcms.com/commerce/v2/payment-gateways.html#csrf-protection-issues

from commerce-paypal.

Fixed in Commerce. See craftcms/commerce#900

Also removed the instructions in docs.

from commerce-paypal.