Fix · Payments

After paying, the customer comes back logged out or with an empty cart

Blocks your workNot checked against the vendor's current screens

What you may see

The return page shows an error or asks me to log in again
It breaks only when the gateway sends the customer back with a form post

Most likely cause

The return from another website can drop strict cookies, or a protection rule (CORS, CSRF) blocks the gateway's request to your return address.

Check first (about two minutes)

Is the return a normal link (GET) or a form post from the gateway? Look at the Network tab.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a very careful senior engineer who knows online payments (including payment gateways used in Kuwait) and explains them to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

Menu and button names change over time. If you cannot find a button or page I mention, say so and tell me what to look for instead of guessing.

THE PROBLEM
After paying, the customer comes back logged out or with an empty cart

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
The return from another website can drop strict cookies, or a protection rule (CORS, CSRF) blocks the gateway's request to your return address.

DO THESE STEPS, IN THIS ORDER
1. Find the return route and what it needs (cookies, tokens, headers).
2. Make the return page identify the order by the payment reference in the address, then verify the payment with the gateway on the server; do not depend on the visitor's session.
3. Use lax cookies for the session so a normal link return keeps the login, and exempt only this one route from CSRF checks (not from verification).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- After a test payment the customer lands on a correct receipt page, logged in or not.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not turn off CSRF protection site-wide.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Find the return route and what it needs (cookies, tokens, headers).
Make the return page identify the order by the payment reference in the address, then verify the payment with the gateway on the server; do not depend on the visitor's session.
Use lax cookies for the session so a normal link return keeps the login, and exempt only this one route from CSRF checks (not from verification).

Do not do this

Do not show order details to anyone who guesses an order number.
Do not turn off CSRF protection site-wide.

Try another entry