We are facing the session expire issue, while, return from payment gateway.

We are integrated CCavenue Magento 2.3.4 Toolkit,

we are tried following ways

  1. Cache => somebody told maybe problem of cache content checkout and cart pages, so we tried to disable full page cache, then tried.
  2. Cookie Domain Mismatch => we are given the right hostname in cookie configuration.
  3. Stickie Session => we follow this blog, they suggested to use SameSite=lax.

Still, the session expires, after return from the payment gateway. we debug our toolkit, the session is there, before redirected to the payment gateway. after return from payment gateway only. session expires.

Suggest me, what is the issue and how to fix this.

  • Facing same issue with CCavenue (2.3.7) in Magento 2.4.1 where the user is getting redirected to the empty page and being logged out instead of being shown the OnePage Checkout Sucess Page. Commented Apr 9, 2021 at 14:02
  • @RoydenRego I have posted my answer, pls check that Commented Apr 10, 2021 at 6:14
  • If you are using a custom order email confirmation template check that your order confirmation email is not calling any custom templates - to test switch back to the default confirmation email template. I had an issue where the confirmation email was clearing the session due to a call to a phtml template in the email.
    – paj
    Commented Apr 10, 2021 at 12:11

1 Answer 1


The issue is Chrome 80+ and all other modern browsers, they are updating their cookie policy. The cookie policy is Third-Party not going to access the current browser cookie.

So, We are using any third party plugins like payment gateway, while payment its redirected to their payment gateway only. when come back to our merchant site, merchant site not allowed to use cookie information. Thats why, we are facing that issue.

It Means, Moden browsers SameSite=Lax by default, If SameSite=Lax by default means, Merchant site not allow to use cookies for third party sites.

So, We have to set SameSite=None; Secure for the thrid party pages. Then only third party site can assess the session and update the order status.

After searching regarding this issue.

I have found a partial solution from Magento GitHub to update some core code. For my project, I am using the following configuration.

Magento 2.4.1, PHP 7.3 and Apache 2.4

Goto this file Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata

protected $request;

public function __construct(RequestInterface $request, $metadata = [])
    if (!isset($metadata[self::KEY_HTTP_ONLY])) {
        $metadata[self::KEY_HTTP_ONLY] = true;

    // PATCH
    $this->request = $request;

    if (!isset($metadata[self::KEY_SAME_SITE])) {
        // $metadata[self::KEY_SAME_SITE] = 'Lax';
        $isSecure = $this->getSecure();
        $metadata[self::KEY_SAME_SITE] = $isSecure ? 'None' : 'Lax';
    //~ PATCH

For Apache, add below script in .htaccess file located at root directory

 <If "%{HTTP_USER_AGENT} =~ /(iPhone; CPU iPhone OS 1[0-2]|iPad; CPU OS 1[0-2]|iPod touch; CPU iPhone OS 1[0-2]|Macintosh; Intel Mac OS X.*Version\x2F1[0-2].*Safari|Macintosh;.*Mac OS X 10_14.* AppleWebKit.*Version\x2F1[0-3].*Safari|(Chrom[^ \x2F]+\x2F(([4-5][0-9])|([6][0-7]))[\.\d]*[ ]))/i">
   Header always edit Set-Cookie "^(.*)(;[ ]?SameSite=None|;[ ]?samesite=None)(.*)?$" "$1$3"

For Nginx, with this code you can define all your application cookies as secure, httponly and/or samesite using proxy_cookie_path (http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path)

location / {
    # your usual config ...
    # hack, set all cookies to secure, httponly and samesite (strict or lax)
    proxy_cookie_path / "/; secure; HttpOnly; SameSite=none";

For PHP 7.3 and above, set following configuration in php.ini file

session.cookie_samesite = "None"

session.cookie_secure = 1

After that, run that following commands and try it out.

php bin/magento setup:upgrade 

php bin/magento setup:di:compile

php bin/magento setup:static-content:deploy -f 

php bin/magento indexer:reindex 

php bin/magento cache:clean  

then, see, Inspect elements in browser, For that third party pages only you can see SameSite=None; Secure and all other pages use SameSite=Lax. Then yor are configuration is right. its will works fine.

  • Third party payment gateways create their own cookies and sessions - this is nothing to do with Magento - and is not accessed by Magento. The Magento customer session should remain when returned from the payment gateway and cannot be changed by the payment gateway.
    – paj
    Commented Apr 10, 2021 at 12:20
  • This fix also requires adding this if ($secure) { $this->set(self::KEY_SAME_SITE, 'None'); } condition before the return statement to the setSecure function of the Magento/Framework/Stdlib/Cookie/PublicCookieMetadata.php file. Commented Apr 16, 2021 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.