I am building a php website (https://demosite.tripura.gov.in/) where logged in users can do payment for some service. Now what happens is that, payment happens successfully (debit from bank) and as expected after payment user is redirected to a payment success page (pay_response.php) but SOMETIMES it doesn't, it automatically logged out and goes to site homepage. The fun fact is, from localhost site it always works, but from production it sometimes works sometimes not.
Any suggestion to change the flow / or to update code ?
This is my payment page (payment.php)-
<?php
session_start();
// check session
if (!isset($_SESSION["user_mobile"])) {
header("Location: index.php");
exit();
}
// headers
header("X-Frame-Options: SAMEORIGIN");
header('X-Content-Type-Options: nosniff');
header("X-XSS-Protection: 1; mode=block");
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';");
header("Referrer-Policy: same-origin");
?>
<html>
<head></head>
<body>
<?php
$merchant_id = "xxxx";
$security_id = "xxxx";
$checksum_key = "xxxx";
$customer_id = round(microtime(true) * 10000);
$amount = 10.00;
$additionaltxt1 = xxxx;
$user_uid = xxxx;
$return_url = 'https://demosite.tripura.gov.in/pay_response.php';
$str = $merchant_id . '|' . $customer_id . '|NA|'.$amount.'|NA|NA|NA|INR|NA|R|'.$security_id .
'|NA|NA|F|' . $additionaltxt1 . '|'.$user_uid.'|NA|NA|NA|NA|NA|'.$return_url;
$checksum = strtoupper(hash_hmac("sha256", $str, $checksum_key, false));
$payment_string = $str . '|' . $checksum;
?>
<form method="POST" action="https://pgi.billdesk.com/pgidsk/PGIMerchantPayment">
<input type="hidden" name="msg" value="<?php echo $payment_string; ?>">
<input type="Submit" class="btn btn-primary btn-md" value='PAY'>
</form>
</body>
</html>
My payment success page (pay_response.php)-
<?php
session_start();
// check session
if (!isset($_SESSION["user_mobile"])) {
header("Location: index.php");
exit();
}
?>
<!doctype html>
<html lang="en">
<html>
<head>
</head>
<body>
<?php
$resp_str = $_POST['msg']; // msg holds the payment response sent from gateway
$resp_arr = preg_split("/\|/", $_POST['msg']);
$response_code = $resp_arr['14'];
echo $response_code;
// storing payment response to database
?>
</body>
</html>