On returning from a successful transaction on SagePay (server), I am getting the following error: Security Signature is not valid



the check against the VPSSignature is intermittently throwing an error. This is because the md5 hash needs to include the SecurityKey (given by SagePay) but Cartthrob is losing this somewhere.

Although the sage_key is being saved successfully in

Cartthrob_payments.php -> save_cart_snapshot

on occasions this item from $this->EE->cartthrob->cart_array() is no longer available and therefore the md5 hash created for verification is incorrect.

Strangely, most of the other data in $this->EE->cartthrob->cart_array() are available.

cartthrob>payment_gateways>cartthrob_sage_s.php extload($post)

where is it getting $this->order from? It is at this point that the sage_key has already got lost.

I've tried setting the Website Session Type to "Cookies and Session ID" and also to "Session Only". The problem remains.

Do you have any idea why the sage_key in the cart array is being lost?

  • Did you ever come up with a fix for this? I'm also having this issue with 2.7 / 2.71 with only SOME orders. SagePay have said that the payment went through correctly, but when responding back to the site that we rejected it (Failed Order). But payment was taken from SagePay
    – Jason Mayo
    May 12, 2016 at 13:41
  • 1
    I really can't remember what the outcome of this was. I would suggest upgrading to the latest versions of EE and Cartthrob. Sorry not to be more helpful. Best of luck. May 16, 2016 at 16:35
  • Updated both (Not to EE3 though) and still no luck :( Might need to contact Vector Media Group with regards to this problem.
    – Jason Mayo
    May 18, 2016 at 12:10
  • It could be a conflict with another plugin. You could try disabling the other plugins and test to find which one it is. I know that's a pain if you have a lot of plugins and/or the site won't work without them. Let me know if you discover what it was. May 22, 2016 at 7:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.