When payment is made, it either succeeds or fails for whatever reason. In this case, though not important, the payment is made on a third party payment website, like Paypal, and a callback url is supplied for success or failure.

My question is should that success or error page expire, that is start returning a 404 after a set time or even immediately after it has been accessed once. There might be no security implications for allowing a notifications page live on forever, so this is more of a best practice question. But if there're security implications, I'll be glad to hear them.

Thank you

1 Answer 1


No. You generally use the same call back for all payments and the 3rd parties API will expect it to always be there and conform to the spec.

Also, returning a 404 generally wont reverse the payment or anything.

If you miss a callback for some reason there is usually a backup polling method you can use to check the status of a payment.

  • Ok that makes sense. However, the 404 thing is not really for the payment processor rather for users refreshing the same payment success page maybe days later. The callback url is usually static like example.com/payment-callback. But I now see my question only applies where the payment processor allows some sort of dynamic callback like example.com/payment-callback?payment-id=foo. Thanks for the answer, I guess no expiry is the way to go
    – Richard
    Jul 22, 2020 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.