Apache configuration disallowing another website from accessing an osCommerce 'callback script'

Posted on 2006-11-16
Last Modified: 2010-03-04
I have a website which is in osCommerce and is using an external payment provider (SecPay)  to deal with transactions.

When I reach checkout confirmation and confirm my order, it goes to the payment provider and variables are passed correctly.

When the payment has been processed and confirmed with the payment provider, it is meant to return to my site (checkout_confirmation.php I think is the page it goes back to) and I assume pass some variables back.

According to the payment provider, this is failing (determined by an error on their page at the end of payment) because "Apache may not be configured to allow their website access to our callback script".

What should I be looking for in httpd.conf to solve this?
Any other comments or suggestions appreciated.
Question by:wbstech
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
LVL 57

Expert Comment

ID: 17961242
Check out any all statments that say "deny".  Check all of Apache's conf files.  httpd.conf is the main one, but say you are running this on Linux, you may have a directory call /etc/httpd/conf.d which has other conf files that could be used.

You would first check out the Directory definition for the directory where the "checkout_confirmation.php" file resides.


Author Comment

ID: 17963552
Ok I can't really see anything that may be blocking it. But i'll post up some (possibly) relevant chunks of httpd.conf that may help:

-------------------------chunk 1----------------------------------------------
# Each directory to which Apache has access, can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
# First, we configure the "default" to be a very restrictive set of
# permissions.  
<Directory />
Options All
AllowOverride All
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.

# This should be changed to whatever you set DocumentRoot to.
<Directory "/usr/local/apache/htdocs">

# This may also be "None", "All", or any combination of "Indexes",
# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
    Options Indexes FollowSymLinks MultiViews

# This controls which options the .htaccess files in directories can
# override. Can also be "All", or any combination of "Options", "FileInfo",
# "AuthConfig", and "Limit"
    AllowOverride None

# Controls who can get stuff from this server.
    Order allow,deny
    Allow from all

-------------------chunk 2 (Virtual host entry for relevant domain)--------------
DocumentRoot /home/mydomain/public_html
BytesLog domlogs/

User mydomain
Group mydomain
CustomLog /usr/local/apache/domlogs/ combined
ScriptAlias /cgi-bin/ /home/mydomain/public_html/cgi-bin/

The directory/file (relative to the domain's home directory) is /catalog/checkout_process.php - This is not specifically configured in any of the configuration files in anyway, that I can find.

And just for the fun of it, here's access.conf:

<Directory />

Options Indexes FollowSymLinks ExecCGI Includes
AllowOverride All

order allow,deny
allow from all

LVL 13

Expert Comment

ID: 17964004
What do you get if you try calling 

does it allow you to view the page/ return a blank page or return a HTTP error. If the later then its being blocked if the error is PHP based or something that the script has generated then your issue is NOT apache.
Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.


Author Comment

ID: 17964016
It goes to that page and redirects me to the index page, exactly as it should, since there is no session or shopping basket.
LVL 13

Expert Comment

ID: 17964060
Right taking a stab in the dark here but it sounds like checkout_process.php is NOT your callback script but the script which handles the shopping basket checkout.

I don't have experience with sec pay but the general terms you have a return page a failure page and a callback script.

A return page is a thank you page which they return the USER to upon successful completion of checkout.
A failure page is a sorry page which they return the USER to upon failure of payment.

These don't have to do anything just act as thank you your order has been paid etc they can clean up the session mark as checkout completed if the order is stored in a database etc.

A Callback Script is a different kettle of fish. Its a script which sits on your server. When checkout is completed Sec pay should send a POST request to this script posting it details of the transaction, the order number, confirmation id etc etc. Using these details you can update the order to PAYMENT TAKEN and then send out "Thank you your payment was taken" e-mails. You normally provide them details of this script and basically only you and them know the url its not part of the checkout process for security purposes.I would suggest contacting Secpay and asking them what url they have for your callback script and what the url is for this script.

Author Comment

ID: 18018084
The problem was solved by implementing SSL.
LVL 13

Accepted Solution

rhickmott earned 500 total points
ID: 18018242
Which would suggest they were trying to callback to https:// then

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

If you've heard about htaccess and it sounds like it does what you want, but you're not sure how it works... well, you're in the right place. Read on. Some Basics #1. It's a file and its filename is .htaccess (yes, with a dot in the front). #…
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question