PayflowPro Checkout Broken with SameSite Cookie Changes from Chrome

[sjb9774]

Summary

Chrome will soon be introducing a new default functionality for cookies that don't explicitly set their "SameSite" property (this article states that stable Chrome 80 should have this functionality but it appears that the cookie changes won't actually be enforced by default until the 17th of this month per https://www.chromium.org/updates/same-site). The Payflow payment method utilizes a callback endpoint (paypal/transparent/response) on Magento invoked from Payflow to complete an order, however that endpoint needs access to the customer's session in order to execute properly. Since the endpoint is invoked from Payflow and not from Magento the new SameSite functionality dictates the that some cookies(session id inclusive) should no longer be passed back to Magento, thus the customer's session cannot be identified/retrieved, and so the request fails, hanging checkout.

Related issue: #26377

Preconditions (*)

1. Fresh Magento 2.3.4 Community Edition installation
2. Payflow Pro (vendor, user, password, partner) configured and enabled
3. Chrome 80.0.3987.100 or greater
4. Navigate to chrome://flags and set "SameSite by default Cookies" and "Cookies with SameSite must be secure" flags to "Enabled"
   
5. Relaunch Chrome

Steps to reproduce (*)

1. Navigate to your storefront
2. Add any item with price greater than $0 to your cart and proceed to checkout
3. Wait at least two minutes from initially opening your session to complete checkout to avoid the exception Chrome has cookies less than 2 minutes old, per https://www.chromestatus.com/feature/5088147346030592.
4. Proceed through checkout using Payflow credit card
5. Click "Place Order"

Expected result (*)

1. Successful checkout

Actual result (*)

1. Failed checkout
   

Review \Magento\Paypal\Controller\Transparent\RequestSecureToken and \Magento\Paypal\Controller\Transparent\Response to see what information from the session is required during checkout.

[m2-assistant]

Hi @sjb9774. Thank you for your report.
To help us process this issue please make sure that you provided the following information:

• Summary of the issue
• Information on your environment
• Steps to reproduce
• Expected and actual results

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento give me 2.4-develop instance - upcoming 2.4.x release

For more details, please, review the Magento Contributor Assistant documentation.

@sjb9774 do you confirm that you were able to reproduce the issue on vanilla Magento instance following steps to reproduce?

• yes
• no

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.

[sjb9774]

@magento give me 2.4-develop instance

[magento-engcom-team]

Hi @sjb9774. Thank you for your request. I'm working on Magento 2.4-develop instance for you

[magento-engcom-team]

Hi @sjb9774, here is your Magento instance.
Admin access: https://i-26840-2-4-develop.instances.magento-community.engineering/admin_a9f4
Login: b598bea6 Password: 2cfbfba2fea6
Instance will be terminated in up to 3 hours.

[sjb9774]

This is readily reproducible on a fresh 2.4-develop instance as well

[viktym]

I confirm this issue with PayPal Payflowpro, @magento-engcom-team please create internal issue and assign it on MPI team
@sjb9774 Thanks for reporting, the fix will be available till the end of the week

[magento-engcom-team]

✅ Confirmed by @sdzhepa
Thank you for verifying the issue. Based on the provided information internal tickets MC-31573 were created

Issue Available: @sdzhepa, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.

[m2-assistant]

Hi @viktym. Thank you for working on this issue.
Looks like this issue is already verified and confirmed. But if you want to validate it one more time, please, go though the following instruction:

• 1. Add/Edit Component: XXXXX label(s) to the ticket, indicating the components it may be related to.

• 2. Verify that the issue is reproducible on 2.4-develop branch

  Details

  - Add the comment @magento give me 2.4-develop instance to deploy test instance on Magento infrastructure.
  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!

• 3. If the issue is not relevant or is not reproducible any more, feel free to close it.

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.