After concluding checkout flow on site I'm redirected to offsite payment service (Datatrans). There if I finish payment and I get redirected back to:


or I cancel payment and get redirected back to:


on site I get the message:

You are not authorized to access this page.

At that point I'm not logged out - if I just reload the page (click on browser address bar and hit enter to open page again. I get redirected to:


Important - this happens only in Google Chrome. In Firefox this works well.

  • 1
    Did you test with an incognito window?
    – No Sssweat
    Oct 1, 2020 at 7:24
  • No, standard way. I'm logged in regularly. And as far as I could see in Firefox it works well, but Chrome is having this issue.
    – MilanG
    Oct 1, 2020 at 8:52
  • 1
    You need to check in Incognito to rule out browser plugins
    – Clive
    Oct 1, 2020 at 8:59
  • Tried incognito mode and it also happens. On FF I get redirected to order information page with message "You have canceled checkout at Datatrans but may resume the checkout process here when you are ready. ", but on Chrome (even in incognito mode) I stay on checkout/order_id/payment/cancel with message "You are not authorized to access this page.", and if I refresh the page then I'm redirected to order information with proper message.
    – MilanG
    Oct 1, 2020 at 10:19
  • 1
    Having the same issue here with Commerce Datatrans module. Nothing that I have tried so far worked for me, incl. your solution. I always end up with a 403 / Forbidden on checkout/order_number/payment/return path. I am on latest Chrome (86) and the same happens with Brave, Safari and Firefox except that on Safari and Firefox I get a browser alert about the unsafe POST back to D8 before the 403. The message (translated from French) is something like This form will be sent in an unsafe way. Do you really want to send it?. In all cases, Commerce then thinks there was an issue with the payment.
    – MrUpsidown
    Oct 29, 2020 at 21:31

1 Answer 1


Possible solution would be adding following rows to .htaccess file inside <IfModule mod_headers.c> block.

  Header always edit Set-Cookie (.*) "$1; SameSite=None; Secure"
  Header onsuccess edit Set-Cookie (.*) "$1; SameSite=None; Secure"

Some more info on this issue:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.