- Can I install orderly/paypal-ipn-bundle in a Laravel application?
- No. It is a Symfony2 bundle that ships a Bundle subclass, a DependencyInjection extension, YAML/XML service definitions and an HttpKernel event subscriber, with no ServiceProvider, facade, publishable config or route registration. Composer may resolve the namespace, but Laravel will never boot it, and the symfony/symfony ~2.x constraints conflict with Laravel 9, 10 and 11. Treat it as reference material rather than an installable package.
- Is this PayPal IPN bundle still maintained and safe for production?
- No. The repository is archived and unmaintained, with zero dependents and a very low package score, so nothing about it is load-bearing for anyone. There are no security patches, no PHP 8.x compatibility work and nobody responding to PayPal API changes. Its era also predates most modern IPN hardening guidance, so any port needs its own security review.
- How does the PayPal IPN validation handshake actually work?
- Preserve the inbound POST body byte-for-byte, prepend cmd=_notify-validate, and re-POST the entire payload back to PayPal at https://ipnpb.paypal.com/cgi-bin/webscr for live or https://ipnpb.sandbox.paypal.com/cgi-bin/webscr for sandbox. Compare the raw response body to VERIFIED before you trust anything in the payload. The whole handshake is roughly 100 to 200 lines of first-party code, which is why porting beats adopting.
- Which PHP and Laravel versions does this bundle support?
- It targets Symfony 2 and PHP 5.3/5.4-era syntax, pinning symfony/symfony ~2.x and an HTTP client abstraction that no longer exists. That makes it incompatible with PHP 8.2+ and Laravel 10 or 11, and the bundle API it relies on is gone even in Symfony 5, 6 and 7. Realistically there is no supported combination to target.
- Can I force-install it with composer --ignore-platform-reqs?
- The classes will autoload, but they cannot be instantiated because the container wiring, bundle extension and HTTP client dependencies are all missing. You end up with dead code in vendor and a dependency tree you cannot reason about. Do not do this in a production application; port the logic instead.
- How do I port this bundle's IPN logic into Laravel?
- Fork the roughly 200 lines of validation logic into a standalone class behind PSR-18 and PSR-3 interfaces, then wire it into a Laravel controller or queued job. Keep the raw request body intact, use Laravel's HTTP client against the correct PayPal endpoint, log every attempt and persist the payload for audit. Reimplementing it from the IPN specification directly takes under a day.
- What security checks must I add beyond checking for VERIFIED?
- A handler that only checks for VERIFIED is exploitable and will mis-account payments. You must also assert that receiver_email or business matches your merchant account, that mc_gross and mc_currency match the expected order total, that payment_status is the expected terminal state, and that txn_id has not already been processed. Persist the payload and the checks before you fulfil the order.
- How should I handle duplicate and out-of-order IPN notifications?
- PayPal retries IPNs for days and can deliver duplicates or out-of-order events, so idempotency is a hard requirement rather than a nicety. Put a unique constraint on txn_id alongside a status column and short-circuit anything you have already seen. You also need a reconciliation path for orders where an IPN never arrives at all.
- Should I use PayPal IPN or migrate to webhooks?
- IPN still functions for legacy Website Payments Standard and Express accounts, but PayPal's documented direction is webhooks. If you have no hard constraint such as a legacy merchant account or existing subscription buttons, start on webhooks and avoid accruing migration debt immediately. Confirm which PayPal product and account type the team actually holds before choosing.
- What are the maintained alternatives for PayPal payments in Laravel?
- For a maintained third-party dependency, look at omnipay/paypal or PayPal's REST SDK with webhooks, both of which support modern PHP and current Laravel releases. They give you security patches and a supported upgrade path. This bundle is best kept as documentation for how the IPN handshake and logging model should behave.