I am trying to integrate payment gateway with Paypal express. the issue is the payment gateway sends post data from paypal express checkout back to a specific URL in our ExpressionEngine but does not contain the parameter XID which is required by ExpressionEngine secure formS as of version 2.7.x

is there a way to accept the incoming post from external website without disabling the settings: $config['secure_form'] = 'n';



You must create a module and a module action. There are docs here. The key is to grant your action a CSRF exemption, like so:

ee()->db->insert('actions', array(
  'class' => 'Module_name' ,
  'method' => 'method_to_call',
  'csrf_exempt' => 1,

Look up the action_id in the exp_actions table for your newly created action. Your action can now be triggered via url without XID at http://yoursite.com/?ACT=XX, where XX is your action_id.

  • This is not working for SagePay Offsite module, still get "The action you have requested is invalid." Jun 3 '14 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.