Using Cartthrob 2.4 and EE 2.7, paying via Worldpay, returns this message:

the action you have requested is invalid

My guess is its the new security introduced for POST requests, that require a new XID set, so does anyone know how to deal with this for external websites like Worldpay submitting call backs?


4 Answers 4


We have fixed this with a couple of changes, seems Cartthrob has a couple of issues...

1) Based on this post XID POST from third party we added the we added 'csrf_exempt' => 1 into the database for the payment_return_action in the Cartthrob exp_actions table. We do not know if this helped, but seems like we should do it. Carttrhob does not add this in when installed or updated.

2) Next issue the callback URL to enter into Worldpay was not working, http:// or , so we managed to find out this URl should be http://ourdomain.co.uk/themes/third_party/cartthrob/lib/extload.php/worldpay_redirect, so we entered that into Worldpay and that works, almost....

3) The callback page showed an error along the lines of "Cartthrob detected an incorrect system folder path, update the system folder path in Extload: extload.php". Or something along those lines. It seems Carttrhob assumes our system folder will be called system. For security we renamed it. Why on earth Carttrhob does not use the setting in EE index.php, and there is no instruction about this, so we updated our system folder path in third_party/cartthrob/lib/extload.php and now it all works OK.

So I guess 3 issues needed to be fixed to get Carttrhob Worldpay to accept payments.

  • The above is not working with SagePay offsite module though :(. Still getting "The action you have requested is invalid" with Sagepay. Commented Jun 3, 2014 at 20:44
  • I just had the same issue with the SagePay Direct payment gateway using CartThrob 2.5 and EE 2.7.3. Following point 1 fixed the issue for me, thanks.
    – Stephen
    Commented Jun 28, 2014 at 0:03

We were able to get this working by following point 1 above using CT2.4 with EE2.7.2 with the PayPoint.net gateway (https://github.com/dmlogic/ct_paypoint)


I'm having similar issues with Sagepay and getting nowhere fast (frustrating lack of support!). However, I thought I should add that you can edit extload.php with your custom system name (and location) - so you don't have to stick with 'system'


Due to the new EE security preventing forms being submitted without an XID (therefore third party gateways can't submit POST notifications), we now use this in our config.php file for Payment Gateways

| Disable CSRF for Sagepay
| This will disable CSRF for Sagepay Request, so payment will work
if(stripos($_SERVER["REQUEST_URI"],'/themes/third_party/cartthrob/lib/extload.php/sage_s') !== FALSE)
    $config['disable_csrf_protection'] = "y";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.