Preserve asp.net Session Data on Authorize.NET webhook response

Question

I am trying to upgrade Authorize.NET from CIM to Accept Hosted, and stuck on this problem:

Authorize.NET Accept Hosted needs 2 urls for the configuration.

1. Return URL, which redirects the user to home page, after a successful payment.
2. A webhook url, to which the Authorization.Net webhook will post transID.

On redirect, I need to access application specific payment details, which are stored in the current session. Note: These are not the authorize.net payment details, I can get them from webhook->transID->GetTransactionDetails

In CIM, the redirect url contained the Payment information from AuthorizeNET(transID, etc.), as well as the app-specific session Payment information. So I was able to process both of them in a single handler, which was called on the redirect.

However in the new api, when a webhook sends post data on my webhook URL, it does it asynchronously, using a different session than the session on which payment was made. So when I receive transID and subsequent payment details from AuthorizeNET, it has no idea about the session dependent application specific payment details.

My question is, how can I preserve the session-specific data, after I receive the Authorize.Net's payment details?

Has anyone encountered a similar problem? What's the best approach to fix this?

Answer 1

You can't maintain a session across systems so you need an alternative way of storing that data and retrieving it once the user returns to your site. A common way to do this is to persist that data in a database and storing the identifier for that data in a cookie or in a custom field that Authorize.Net will pass through for you as part of the transaction and returning redirect. In this case the return URL you pass in hostedPaymentReturnOptions.url can containa query string with that identifier (ie https://www.yoursite.com/return_url?id=12345 ). Then once the user returns back to your site you can use that identifier to retrieve their session data from the database and add it back into their session.