Apache configuration disallowing another website from accessing an osCommerce 'callback script'

Posted on 2006-11-16
Last Modified: 2010-03-04
I have a website which is in osCommerce and is using an external payment provider (SecPay)  to deal with transactions.

When I reach checkout confirmation and confirm my order, it goes to the payment provider and variables are passed correctly.

When the payment has been processed and confirmed with the payment provider, it is meant to return to my site (checkout_confirmation.php I think is the page it goes back to) and I assume pass some variables back.

According to the payment provider, this is failing (determined by an error on their page at the end of payment) because "Apache may not be configured to allow their website access to our callback script".

What should I be looking for in httpd.conf to solve this?
Any other comments or suggestions appreciated.
Question by:wbstech
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
LVL 57

Expert Comment

ID: 17961242
Check out any all statments that say "deny".  Check all of Apache's conf files.  httpd.conf is the main one, but say you are running this on Linux, you may have a directory call /etc/httpd/conf.d which has other conf files that could be used.

You would first check out the Directory definition for the directory where the "checkout_confirmation.php" file resides.


Author Comment

ID: 17963552
Ok I can't really see anything that may be blocking it. But i'll post up some (possibly) relevant chunks of httpd.conf that may help:

-------------------------chunk 1----------------------------------------------
# Each directory to which Apache has access, can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
# First, we configure the "default" to be a very restrictive set of
# permissions.  
<Directory />
Options All
AllowOverride All
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.

# This should be changed to whatever you set DocumentRoot to.
<Directory "/usr/local/apache/htdocs">

# This may also be "None", "All", or any combination of "Indexes",
# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
    Options Indexes FollowSymLinks MultiViews

# This controls which options the .htaccess files in directories can
# override. Can also be "All", or any combination of "Options", "FileInfo",
# "AuthConfig", and "Limit"
    AllowOverride None

# Controls who can get stuff from this server.
    Order allow,deny
    Allow from all

-------------------chunk 2 (Virtual host entry for relevant domain)--------------
DocumentRoot /home/mydomain/public_html
BytesLog domlogs/

User mydomain
Group mydomain
CustomLog /usr/local/apache/domlogs/ combined
ScriptAlias /cgi-bin/ /home/mydomain/public_html/cgi-bin/

The directory/file (relative to the domain's home directory) is /catalog/checkout_process.php - This is not specifically configured in any of the configuration files in anyway, that I can find.

And just for the fun of it, here's access.conf:

<Directory />

Options Indexes FollowSymLinks ExecCGI Includes
AllowOverride All

order allow,deny
allow from all

LVL 13

Expert Comment

ID: 17964004
What do you get if you try calling 

does it allow you to view the page/ return a blank page or return a HTTP error. If the later then its being blocked if the error is PHP based or something that the script has generated then your issue is NOT apache.
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI


Author Comment

ID: 17964016
It goes to that page and redirects me to the index page, exactly as it should, since there is no session or shopping basket.
LVL 13

Expert Comment

ID: 17964060
Right taking a stab in the dark here but it sounds like checkout_process.php is NOT your callback script but the script which handles the shopping basket checkout.

I don't have experience with sec pay but the general terms you have a return page a failure page and a callback script.

A return page is a thank you page which they return the USER to upon successful completion of checkout.
A failure page is a sorry page which they return the USER to upon failure of payment.

These don't have to do anything just act as thank you your order has been paid etc they can clean up the session mark as checkout completed if the order is stored in a database etc.

A Callback Script is a different kettle of fish. Its a script which sits on your server. When checkout is completed Sec pay should send a POST request to this script posting it details of the transaction, the order number, confirmation id etc etc. Using these details you can update the order to PAYMENT TAKEN and then send out "Thank you your payment was taken" e-mails. You normally provide them details of this script and basically only you and them know the url its not part of the checkout process for security purposes.I would suggest contacting Secpay and asking them what url they have for your callback script and what the url is for this script.

Author Comment

ID: 18018084
The problem was solved by implementing SSL.
LVL 13

Accepted Solution

rhickmott earned 500 total points
ID: 18018242
Which would suggest they were trying to callback to https:// then

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In my time as an SEO for the last 2 years and in the questions I have assisted with on here I have always seen the need to redirect from non-www urls to their www versions. For instance redirecting ( to http…
Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : All lightning effects with instructions : http://www.mediaf…

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question