There is a strange issue in 2c2p payment module response. I am getting following browser output in that response page:

Set-Cookie: form_key=ErTfIwyNgOEzYNGk; expires=Thu, 05-Sep-2019 09:54:01 GMT; Max-Age=3600; path=/; domain='my-domain'
Set-Cookie: mage-messages=%5B%7B%22type%22%3A%22error%22%2C%22text%22%3A%22Invalid+Form+Key.+Please+refresh+the+page.%22%7D%5D; expires=Fri, 04-Sep-2020 08:54:01 GMT; Max-Age=31536000; path=/

But the issue is it is treating this form key as expired and then redirecting to home page with message invalid form-key. Please refresh the page. Also the timezone is also set to UTC.

Here is my response controll of 2c2p module which I have dowloaded it from here: https://developer.2c2p.com/docs/magento2 (in installation section)

 * Created by 2C2P
 * Date 20 June 2017
 * This Response action method is responsible for handle the 2c2p payment gateway response.

namespace P2c2p\P2c2pPayment\Controller\Payment;

class Response extends \P2c2p\P2c2pPayment\Controller\AbstractCheckoutRedirectAction
    public function execute()
        //If payment getway response is empty then redirect to home page directory.     
        if(empty($_REQUEST) || empty($_REQUEST['order_id'])){

        $hashHelper   = $this->getHashHelper();
        $configHelper = $this->getConfigSettings();
        $objCustomerData = $this->getCustomerSession();
        $isValidHash  = $hashHelper->isValidHashValue($_REQUEST,$configHelper['secretKey']);

        //Get Payment getway response to variable.
        $payment_status_code = $_REQUEST['payment_status'];
        $transaction_ref     = $_REQUEST['transaction_ref']; 
        $approval_code       = $_REQUEST['approval_code'];
        $payment_status      = $_REQUEST['payment_status'];
        $order_id            = $_REQUEST['order_id'];

        //Get the object of current order.
        $order = $this->getOrderDetailByOrderId($order_id);

        //If order is empty then redirect to home page. Because order is not avaialbe.
        if(empty($order)) {

        //Check whether hash value is valid or not If not valid then redirect to home page when hash value is wrong.
        if(!$isValidHash) {


        $metaDataHelper = $this->getMetaDataHelper();       

        //check payment status according to payment response.
        if(strcasecmp($payment_status_code, "000") == 0) {          
            //IF payment status code is success

            if(!empty($order->getCustomerId()) && !empty($_REQUEST['stored_card_unique_id'])) {
                $intCustomerId = $order->getCustomerId();
                $boolIsFound = false;

                // Fetch data from database by using the customer ID.
                $objTokenData = $metaDataHelper->getUserToken($intCustomerId);

                $arrayTokenData = array('user_id' => $intCustomerId,
                    'stored_card_unique_id' => $_REQUEST['stored_card_unique_id'],
                    'masked_pan' => $_REQUEST['masked_pan'],
                    'created_time' =>  date("Y-m-d H:i:s"));

                   Iterate foreach and check whether token key is present into p2c2p_token table or not.
                   If token key is already present into database then prevent insert entry otherwise insert token entry into database.
                foreach ($objTokenData as $key => $value) {
                    if(strcasecmp($value->getData('masked_pan'), $_REQUEST['masked_pan']) == 0 && 
                       strcasecmp($value->getData('stored_card_unique_id'), $_REQUEST['stored_card_unique_id']) == 0) {
                        $boolIsFound = true;

                if(!$boolIsFound) {

            //Set the complete status when payment is completed.


        } else if(strcasecmp($payment_status_code, "001") == 0) {           
            //Set the Pending payment status when payment is pending. like 123 payment type.


        } else {
            //If payment status code is cancel/Error/other.

You did not mention anything about the payment module you are using.So I assume you are using a payment module name "Abc_PaymentModule". I also assume in that payment module there is a controller which is handling the response back from payment gateway. It seems you are getting Form-Key error due to CSRF (Cross-Site Request Forgery) tokens on form POST submissions.

So based on My assumption, You may try the solution I provided below.

step 1)

Create a custom module. Assume your custom module name is MyCompany_Module

step 2)

set sequence under your custom module etc folder module.xml

File: app/code/MyCompany/Module/etc/module.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="MyCompany_Module" setup_version="1.0.0">
            <module name="Abc_PaymentModule"/>

step 3)

Create di.xml and set the preference to override controller of the 3rd party module (i.e Abc_PaymentModule)

File: app/code/MyCompany/Module/etc/di.xml

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Abc\PaymentModule\Controller\Index\PlaceOrder" type="MyCompany\Module\Controller\Index\PlaceOrder"/>

step 4)

Create the controller file

File : app/code/MyCompany/Module/Controller/Index/PlaceOrder.php

namespace MyCompany\Module\Controller\Index;

use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;

class PlaceOrder extends \Abc\PaymentModule\Controller\Index\PlaceOrder implements CsrfAwareActionInterface
     * @inheritDoc
    public function createCsrfValidationException(
        RequestInterface $request
    ): ?InvalidRequestException {
        return null;

     * @inheritDoc
    public function validateForCsrf(RequestInterface $request): ?bool
        return true;


step 5:

Run php bin/magento setup:upgrade and php bin/magento di:compile commands.

| improve this answer | |
  • Thanks but I guess there is no need for this. The issue is the return url from that payment platform is getting 302 redirect and it is not even going to its fixed response controller. – Stack user Sep 5 '19 at 12:02
  • I am attaching that response controller in my question. – Stack user Sep 5 '19 at 12:02
  • I have dowloaded it from here: developer.2c2p.com/docs/magento2 (in installation section) – Stack user Sep 5 '19 at 12:05
  • you are redirecting to the Home page because some error is occurring in request controller. Make sure Last Order id is not null. Please check P2c2p\P2c2pPayment\Controller\Payment\Request.php file – Pritam Info 24 Sep 5 '19 at 13:44
  • No it is fine, I can check the response status on response controller but it has 302 redirect. so it never go to response controller – Stack user Sep 5 '19 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.