Secure “thank you”

[Frisco]

I thought the easiest flow for my users would be:

Pay Now button
If PP verify, then Thank You page
On Thank You page, enter login credentials for future

Then I thought “but what if bad guys hit the ‘thank you’ page a zillion times to enter fake credentials?”.

I think you’ve taken care of that, right? The payerID parameter in the ‘thank you’ URL provides sufficient security from bad guys smashing the ‘thank you’ page, is that true?

[The Assurer]

We use the PayPal IPN to verify payment. HOWEVER, there is a 30-ish percent chance the IPN will not be received before the purchaser is returned to the Thank You page; due to either network traffic or PayPal processing issues. When this happens, registration cannot occur on the Thank You page; and a backup registration link will be emailed to the user, when the IPN is received.

[Frisco]

Then is it recommended that I submit user information to my API along with the PP Pay Now click?

[The Assurer]

It is recommended that you configure your membership payments, in accordance with the SWPM documentation

https://simple-membership-plugin.com/simple-membership-documentation/#:~:text=Login%20After%20Registration-,Membership%20Payment,-Creating%20a%20PayPal

[Frisco]

Oh, lovely. Evidently, I need the Premium Form Builder Addon to redirect following reg. I suspect this will cost a bunch.

[Frisco]

I followed the instructions from this page:

https://simple-membership-plugin.com/paid-registration-from-the-thank-you-page/

The ability to complete registration at Thank You isn’t there (for one of those reasons you describe above).

User is not receiving “backup registration link” via email.

[The Assurer]

You do not have to purchase anything extra. I do not think you understood what I wrote.
Registration from the Thank You page will SOMETIMES fail, if there are network or payment delays, that prevent the IPN from PayPal being received “fast enough.”

Question: Are new members receiving a registration completion link, in their email, after PayPal processes their payment?

[admin]

Few things to note:

#1) The “Thank You” page is already secure. A user cannot register for a paid level without actually paying properly. Just going to the “Thank you” page doesn’t do anything. You need a special link that is ONLY given to the user after a payment is verified.

However, the real registration flow requires the email to be working. The following page explains the registration flow:
https://simple-membership-plugin.com/membership-registration-process-overview/

If email is not working on your server, then our membership plugin won’t really be a good solution for you. Try a different plugin that can work without requiring any email functionality.

Email normally doesn’t work due to a mail server setup issue. The following post is useful for email issues:
https://simple-membership-plugin.com/forums/topic/email-sending-issue-on-your-site/

#2) You don’t need to buy anything for the standard simple registration functionality of our plugin.

#3) You can use the following method of registration and payment handling to improve the process if you think the emails sent from your server won’t work. In this method, the user registers for a free account the makes a payment on the next step. The account is upgraded according the payment that the user makes:

https://simple-membership-plugin.com/allowing-members-create-account-prior-completing-membership-payment/

[Author]

Posts