vb.org Archive - Confused by this email received from PayPal

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB4 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=251)

- - Confused by this email received from PayPal (https://vborg.vbsupport.ru/showthread.php?t=325969)

abozich

01-08-2018 01:27 PM

Confused by this email received from PayPal

Running 4.2.5 and got an email last month from PayPal that says the following:

--

https://vborg.vbsupport.ru/external/2018/01/6.png

It was my understanding that 4.2.5 fixed the IPN postbacks to HTTPS issue within vBulletin. Are they saying I need to move my forum completely over to HTTPS? Was planning to do this anyway in Q1, but just curious if anyone had insight here. Thanks.

Stingray27

01-09-2018 05:29 PM

From the paypal site ;

Quote:

Merchants and partners use Instant Payment Notification (IPN) to receive notifications of events related to PayPal transactions. The IPN message service requires that you acknowledge receipt of these messages and validate them. This process includes posting the messages back to PayPal for verification. In the past, PayPal has allowed the use of HTTP for these postbacks. For increased security going forward, only HTTPS will be allowed for postbacks to PayPal. At this time, there is no requirement for HTTPS on the outbound IPN call from PayPal to the merchant’s IPN listener.

The part in bold is the https postback to paypal, that was fixed to be correct in 4.2.4 onwards.

The second part (in red) confirms that you do not need to use https on your website for the calls from paypal.

(https://www.paypal.com/en/webapps/mp...fication-https)

abozich

01-10-2018 12:52 PM

Quote:

Originally Posted by Stingray27 (Post 2592186)

From the paypal site ;

The part in bold is the https postback to paypal, that was fixed to be correct in 4.2.4 onwards.

The second part (in red) confirms that you do not need to use https on your website for the calls from paypal.

(https://www.paypal.com/en/webapps/mp...fication-https)

Thank you, Stingray.

abozich

01-29-2018 03:15 PM

As a follow up here, I emailed PayPal and was told that the IPN listener I use must be SSL. Does anyone know which file serves as the IPN listener for vBulletin?

Stingray27

01-29-2018 04:14 PM

Quote:

Originally Posted by abozich (Post 2592490)

As a follow up here, I emailed PayPal and was told that the IPN listener I use must be SSL.

Again, this is not the information on their site ;

https://www.paypal.com/in/webapps/mp...fication-https

Quote:

Merchants and partners use Instant Payment Notification (IPN) to receive notifications of events related to PayPal transactions. The IPN message service requires that you acknowledge receipt of these messages and validate them. This process includes posting the messages back to PayPal for verification. In the past, PayPal has allowed the use of HTTP for these postbacks. For increased security going forward, only HTTPS will be allowed for postbacks to PayPal. At this time, there is no requirement for HTTPS on the outbound IPN call from PayPal to the merchant’s IPN listener.

abozich

01-29-2018 04:39 PM

Quote:

Originally Posted by Stingray27 (Post 2592492)

Again, this is not the information on their site ;

https://www.paypal.com/in/webapps/mp...fication-https

Here's my full exchange with them:

https://vborg.vbsupport.ru/external/2018/01/10.png

Dave	01-29-2018 05:22 PM

That means that your site should run on HTTPS, or only your payment gateway script.

abozich

01-29-2018 05:24 PM

Quote:

Originally Posted by Dave (Post 2592494)

That means that your site should run on HTTPS, or only your payment gateway script.

They just came back with this:

https://vborg.vbsupport.ru/external/2018/01/11.png

Dave	01-29-2018 05:43 PM

In that case your forum does not need HTTPS, looks like they got confused about the question.

Stingray27

01-29-2018 07:04 PM

Yep, their support gave you wrong information.

Only the postback from you to paypal must be https, there isnt any requirement for your end to be https.

All times are GMT. The time now is 07:11 PM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01143 seconds Memory Usage 1,735KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (6)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: