XID POST from third party

Question

I am trying to integrate payment gateway with Paypal express. the issue is the payment gateway sends post data from paypal express checkout back to a specific URL in our ExpressionEngine but does not contain the parameter XID which is required by ExpressionEngine secure formS as of version 2.7.x

is there a way to accept the incoming post from external website without disabling the settings: $config['secure_form'] = 'n';

Thanks

Answer 1

You must create a module and a module action. There are docs here. The key is to grant your action a CSRF exemption, like so:

ee()->db->insert('actions', array(
  'class' => 'Module_name' ,
  'method' => 'method_to_call',
  'csrf_exempt' => 1,
));

Look up the action_id in the exp_actions table for your newly created action. Your action can now be triggered via url without XID at http://yoursite.com/?ACT=XX, where XX is your action_id.