paypal / paypal-js

Loading wrapper and TypeScript types for the PayPal JS SDK
Apache License 2.0
224 stars 75 forks source link

[Bug] Paypal Button Click opens Overlay to login and an empty Popup #534

Open dkoenigroer opened 1 month ago

dkoenigroer commented 1 month ago

Library used

paypal-js as direct script and npm package.

🐞 Describe the Bug

After loading the payment buttons with the paypal-js sdk and choosing on of the payment methods an overlay with the login form appears. But at the same time a small popup window with "about:blank" and a white blank page opens. This popup hides the login overlay so the customer is not able to see it and stops checkout process most times.

Paypal-Doppel-Login

This behaviour starts on thursday july 4th on all our online shops at the same time.

🔬 Minimal Reproduction

Go to your paypal integration and click one of the payment methods offered by the paypal-js-sdk.

😕 Actual Behavior

See "Describe the Bug"

Before this change only a blocking overlay with a paypal logo and a hint that the process will continue in a pop appears. The pop opens with the login form of paypal.

Now the loginform is displayed as overlay on top of the blocker and the popup is empty.

🤔 Expected Behavior

Either the login should be displayed as overlay as now is happening and no popup should be opened or the old behavoir when the popup displays the loginform is set back and no login overlay in the background.

🌍 Environment

wiffbi commented 1 month ago

We observe the same problem – with the exception that it only happens, when the payment-page, where the Paypal-button is embedded, is inside an iframe.

dkoenigroer commented 1 month ago

I found the problem :/

We added some more security-points to our sites which set the Cross-Origin-Opener-Policy per dafault to same-origin. So i just noticed an error when using a paypal checkout method:

image

So Paypal SDK detects that it pay not open popups and falls back to an iframe in an overlay. But the problem is that the popup opens nonetheless.

The solutions:

Set the Header: Cross-Origin-Opener-Policy: "same-origin-allow-popups" and the old dirty login pop up opens as it did in good old days and displays the login page :)

dkoenigroer commented 1 month ago

Maybe this should be added to the integration documentation of the paypal sdk.

pc-coholic commented 1 month ago

Thing is, this used to work in the past though - so I'd say there is an issue that PayPal needs to fix; irrespective of documentation update or not.

Perhaps you might consider reopening the issue, so that PayPal can close this once they have updated their server-side code?

Thomas-C258 commented 1 month ago

Same error here. I'd much rather have an option to directly display in a modal and prevent the popup's opening...

ravishekhar commented 1 month ago

Acknowledged. We will check and get back.

joomsch commented 2 weeks ago

Is there any way I can force PayPal to use the fallback mechanism so I can replicate this issue? Some of my customers have reported the same problem, but I'm unable to reproduce it on my end, making it difficult to fix.

m2hd1 commented 1 week ago

I'm experiencing the same issue with the blank pop-up. The new modal is fantastic, and I'm glad we're moving away from that pop-up.