When I test with my payment gateway (Sage Pay) I get a server error stating Craft Commerce isn't providing a redirect after payment is received:

Server error 5006: Unable to redirect to Vendor's web site. The Vendor failed to provide a RedirectionURL.

This is what is shown in my error logs: - - [20/Jul/2016:09:05:17 +0100] "POST /index.php/actions/commerce/payments/completePayment?commerceTransactionId=9&commerceTransactionHash=b965d6bb8ca17ffc475849ab878721d5 HTTP/1.1" 404 50171 "-" "SagePay-Notifier/1.0"

Does anyone know what might be causing the redirect issue?

  • 1
    Check the last three points in the solution section - sagepay.co.uk/support/error-codes/… Jul 13, 2016 at 16:22
  • I have checked my logs and updated original message above. Spoken to web host provider and Sage Pay regarding the help article above but none the clearer - which makes me think that it is an issue with how I have set up Craft Commerce. I have replaced some of the redirect values in the template with shop/inkjet-flex/ instead of shop/commerce/ - would that be an issue?
    – Dan Lee
    Jul 21, 2016 at 8:42

2 Answers 2


Looks like your redirect does not contain the full url back to your site.

The error shows: - - [20/Jul/2016:09:05:17 +0100] "POST /index.php/actions/commerce/payments/...

But I would expect to see a url starting with http://sitename.com/ since your gateway needs the full url to redirect you back to your site.

Make sure you have a siteUrl set up in your craft settings: https://craftcms.com/support/site-url

  • 1
    I had the same issue with downloading pdfs on the "My Orders" section. As craft commerce is located in a directory called "shop" example.com/shop "shop" seems to be missing from the URL. <h4>Receipt (<a href="{{ order.getPdfUrl('receipt') }}">Download</a>)</h4> This misses the
    – Dan Lee
    Jul 22, 2016 at 10:07
  • Not sure what you mean, but yes, it is important to set a siteUrl so that urls perform correctly. Jul 22, 2016 at 11:24

We had a similar issue to this recently and found it was caused by CSRF protection being turned on, SagePay is attempting to POST data back to your server but without the CSRF token it becomes an invalid request.

The solution to this is to add a quick check in your config/general.php:

return array(
    'enableCsrfProtection' => !isset($_GET['p']) || $_GET['p'] !== 'actions/commerce/payments/acceptNotification',

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.