Apache configuration disallowing another website from accessing an osCommerce 'callback script'

I have a website which is in osCommerce and is using an external payment provider (SecPay)  to deal with transactions.

When I reach checkout confirmation and confirm my order, it goes to the payment provider and variables are passed correctly.

When the payment has been processed and confirmed with the payment provider, it is meant to return to my site (checkout_confirmation.php I think is the page it goes back to) and I assume pass some variables back.

According to the payment provider, this is failing (determined by an error on their page at the end of payment) because "Apache may not be configured to allow their website access to our callback script".

What should I be looking for in httpd.conf to solve this?
Any other comments or suggestions appreciated.
Who is Participating?
Robin HickmottConnect With a Mentor Software DeveloperCommented:
Which would suggest they were trying to callback to https:// then
Check out any all statments that say "deny".  Check all of Apache's conf files.  httpd.conf is the main one, but say you are running this on Linux, you may have a directory call /etc/httpd/conf.d which has other conf files that could be used.

You would first check out the Directory definition for the directory where the "checkout_confirmation.php" file resides.

wbstechAuthor Commented:
Ok I can't really see anything that may be blocking it. But i'll post up some (possibly) relevant chunks of httpd.conf that may help:

-------------------------chunk 1----------------------------------------------
# Each directory to which Apache has access, can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
# First, we configure the "default" to be a very restrictive set of
# permissions.  
<Directory />
Options All
AllowOverride All
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.

# This should be changed to whatever you set DocumentRoot to.
<Directory "/usr/local/apache/htdocs">

# This may also be "None", "All", or any combination of "Indexes",
# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
    Options Indexes FollowSymLinks MultiViews

# This controls which options the .htaccess files in directories can
# override. Can also be "All", or any combination of "Options", "FileInfo",
# "AuthConfig", and "Limit"
    AllowOverride None

# Controls who can get stuff from this server.
    Order allow,deny
    Allow from all

-------------------chunk 2 (Virtual host entry for relevant domain)--------------
<VirtualHost xx.xxx.xx.xxx>
ServerAlias mydomain.com
ServerAdmin webmaster@mydomain.com
DocumentRoot /home/mydomain/public_html
BytesLog domlogs/mydomain.com-bytes_log
ServerName www.mydomain.com

User mydomain
Group mydomain
CustomLog /usr/local/apache/domlogs/mydomain.com combined
ScriptAlias /cgi-bin/ /home/mydomain/public_html/cgi-bin/

The directory/file (relative to the domain's home directory) is /catalog/checkout_process.php - This is not specifically configured in any of the configuration files in anyway, that I can find.

And just for the fun of it, here's access.conf:

<Directory />

Options Indexes FollowSymLinks ExecCGI Includes
AllowOverride All

order allow,deny
allow from all

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Robin HickmottSoftware DeveloperCommented:
What do you get if you try calling


does it allow you to view the page/ return a blank page or return a HTTP error. If the later then its being blocked if the error is PHP based or something that the script has generated then your issue is NOT apache.
wbstechAuthor Commented:
It goes to that page and redirects me to the index page, exactly as it should, since there is no session or shopping basket.
Robin HickmottSoftware DeveloperCommented:
Right taking a stab in the dark here but it sounds like checkout_process.php is NOT your callback script but the script which handles the shopping basket checkout.

I don't have experience with sec pay but the general terms you have a return page a failure page and a callback script.

A return page is a thank you page which they return the USER to upon successful completion of checkout.
A failure page is a sorry page which they return the USER to upon failure of payment.

These don't have to do anything just act as thank you your order has been paid etc they can clean up the session mark as checkout completed if the order is stored in a database etc.

A Callback Script is a different kettle of fish. Its a script which sits on your server. When checkout is completed Sec pay should send a POST request to this script posting it details of the transaction, the order number, confirmation id etc etc. Using these details you can update the order to PAYMENT TAKEN and then send out "Thank you your payment was taken" e-mails. You normally provide them details of this script and basically only you and them know the url its not part of the checkout process for security purposes.I would suggest contacting Secpay and asking them what url they have for your callback script and what the url is for this script.
wbstechAuthor Commented:
The problem was solved by implementing SSL.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.