PayPal IPN not received for Adaptive Payment from user to user

Question

I'm building a website where users can purchase digital goods that other users have posted for sale. I want to use PayPal Adaptive Payments so that the money directly goes to the seller (not to me).

I have the payments working, but I'm not getting IPN messages unless I use my own PayPal account as the seller (receiver). When any other PayPal account is the receiver my IPN URL doesn't get hit at all.

Can you tell me whether I should expect to get Instant Payment Notifications in this scenario, why it might not be working, or any other way I can find out when the payment is completed?

Update

When I login to PayPal and look at IPN History I can see that it tried to send IPNs to me for the payments to other receivers, but they all got HTTP status code 403. I can also see when it tried to send me an IPN for the payment to myself - this one got HTTP status code 200.

I don't know why it would get a 403 response, because I don't have any kind of access control on that URL. And I don't know why it would only get a 403 when the IPN is for a payment to someone else.

When I look in my web server logs I see PayPal trying to hit my IPN receiver and it mostly gets 404, except the one case where the payment was to myself - this got a 200.

173.0.82.126 - - [23/Jun/2012:15:25:00 +1000] "POST /ajax/paypal/AdaptivePayments/ipn.php HTTP/1.0" 404 - "-" "-"
173.0.82.126 - - [23/Jun/2012:15:24:59 +1000] "POST /ajax/paypal/AdaptivePayments/ipn.php HTTP/1.0" 200 - "-" "-"

I'll check whether there is something in my Apache web server that might be rejecting the POSTs to the IPN receiver based on the body of POST.

Answer 1

I found it is definitely related to having "/../" in the returnUrl and cancelUrl. I have solved the problem by removing the "/../" from the returnUrl and cancelUrl. I didn't think these would be a problem because "/../" is used in the sample in PayPal's Adaptive Payments PHP NVP SDK. I assume it must be some security setting in Apache that is blocking POSTs with bodies containing "/../", but I haven't looked deeply into it.