Session is getting empty when payment gateway posts response to .aspx page

user_4123856 0
Viewed 648

I am Integrating the payment gateway 'First Cardinal Commerce' using c# asp.net(.Net framework 4.0). The payment gateway posts the response values to our merchant website. For that created page called 'Success.aspx' which receive the some of response values from payment gateway which are posted by payment gateway after processing the transaction. I used below code for receiving the response values

request.form["responsecode"]

Here I am facing issue that, the session of the page 'Success.aspx' is getting empty when payment gateway posted response values to this page. I could receive the response values but it is redirected to login page due to the session is empty.

I am using .Net framework version 4.0

Can you please let me know why this is happening and how can retain the session when the page is redirected by payment gateway?

payment-gateway asp.net .net c#
1 Answers

All your ASP.net session cookies are lost when you navigate to an external application and come back.

Get Ready for New SameSite=None; Secure Cookie Settings

With Chrome 80 in February, Chrome will treat cookies that have no declared SameSite value as SameSite=Lax cookies. Only cookies with the SameSite=None; Secure setting will be available for external access, provided they are being accessed from secure connections. The Chrome Platform Status trackers for SameSite=None and Secure will continue to be updated with the latest launch information.

First thing first you need to upgrade the .net framework from 4.0 to at least 4.7.2. or higher.

Why? The updated standard is not backward compatible with the previous standard[...]Microsoft does not support .NET versions lower than 4.7.2 for writing the same-site cookie attribute.

Work with SameSite cookies in ASP.NET

enter image description here

WorkAround for .NET version less than 4.7.2

Modify the ASP.NET Session Cookie (Check if the Cookie Name is customized to a different one in your application). Probably in Global.asax Application_BeginRequest or depending on your code.

protected void Application_BeginRequest(object sender, EventArgs e)
{
    if (Request.Cookies.Count > 0 && Request.Cookies["ASP.NET_SessionId"] != null)
    {
        HttpCookie sessionCookie = Request.Cookies["ASP.NET_SessionId"];
        sessionCookie.Path = "/; SameSite=None";
        sessionCookie.Secure = true;                
        Response.SetCookie(sessionCookie);
    }
}
user_40181800
Related