I've taken on two ee cartthrob sites running off an msm installation. I just moved them to a Nexcess server and updated EE from 2.2.1 to 2.7.2 (and CT from 2.051 to 2.4). Everything is working fine until I try to post data through to sagepay (using the europe offsite option, so no ssl). Every single time I try to proceed to payment, I get this error on the payment confirmation page (without going out to sagepay):

Failed: sage_invalid3037 : The NotificationURL is too long.

I've investigated this thoroughly and have found that some people have solved it by correctly configuring a file called 'extload.php' that handles external payment gateways. However, I've edited this file with correct absolute server paths and msm site id's in both theme folders and I'm still getting the error. I can't get a call scheduled with the cartthrob guys for another two days (and that's the paid for option!) so I'm hoping there may be someone else in the community that has experienced and fixed this issue...?

I'm using cloudflare as a CDN, I don't know if this will have any implications?

I've also tried watching the http headers as I click the 'proceed to payment' button, but can't see anything interesting in there (except Cloudflare giving me a Temporary 302 on the confirmation page that delivers the error).

  • I've found reference to a file on github that's supposed to have remedied this problem, but it's no longer in the cartthrob repository. github.com/CartThrob/payments-sage_offsite_extload -does this mean that it's since been folded into a more recent build of CT? (in which case, it doesn't seem to be working) Commented Nov 20, 2013 at 16:41
  • The same error occurs in test or live mode. Commented Nov 20, 2013 at 16:44
  • This is driving me crazy! I'm using the sage europe offsite payment gateway that ships with CT (and which used to work on the old version of these sites - I've tried the old version without extload.php and that doesn't work either) and if I request extload.php in the browser I don't get any errors (so I'm assuming it's set up correctly). I now have the added complication of having had to roll back to the old sites, so the only way I can now test these sites is by editing my own hosts file - so I will never get a 100% successful transaction back. Getting to sagepay would be a good start :) Commented Nov 21, 2013 at 11:25
  • I've made some changes and am now getting 3011 - The Notification URL format is invalid. Commented Nov 21, 2013 at 16:06
  • I'm trying to decipher from live httpheaders what the notification being used is - according to sagepay it just needs to be a live well-formed url. Is it the return URL? As far as I can see, that's set ok - it's the address of my order_confirm template with some kind of encrypted hash at the end of it, so I would have thought that would work. Commented Nov 21, 2013 at 19:45

1 Answer 1


Take a look in your system folder \expressionengine\third_party\cartthrob\payment_gateways\Cartthrob_sage_s.php file

Somewhere at around line 172 you will see that the $post_array includes the NotificationURL.

Look for this line:

'NotificationURL' => $this->response_script(ucfirst(get_class($this))),

if you add a die statement like this:


You can see what the URL is and that should give you an idea of what is going wrong. The Notification URL should be to your extload.php file in your /themes/third_party/cartthrob/lib/ folder

I hope that this helps. Dorothy

  • Thank you so much Dorothy! That output some handy stuff. I could see that one site was outputting the correct path to extload.php/sage_s while the other site was outputting a relative path, which explained why I was getting further with one site than the other. Now I'm getting a new error at the sage end after entering payment details, which I'm investigating. But your assistance has been invaluable, so thank you. Commented Nov 22, 2013 at 15:12
  • Really pleased that it helped you. I hope you get your next bug sorted. :-) Commented Nov 25, 2013 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.