Not Getting VERIFIED or INVALID reply from server

[maximus57sd]

I have set up an IPN listener using Linux and sockets. I am working with the data raw, for which there is not any documentation that I can find, so I am figuring it out on my own. Everything is good except I am unable to get the proper reply of VERIFIED or INVALID when sending the IPN back to PayPal. Below is the raw data received and sent from a sandbox test. What am I missing or doing wrong?

This is the ipn received:

[POST /mylistener HTTP/1.1
Host: mylistenersite.com
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: PayPal IPN ( https://www.paypal.com/ipn )
correlation-id:e38b432e0aeac
CAL_POOLSTACK:queueserv-http-qtoc:DaemonChild*CalThreadId=0*TopLevelTxnStartTime=171271547dc*Host=slcsbsingle3001
CLIENT_PID:25430
Content-Length: 1037

mc_gross=20.00&protection_eligibility=Eligible&address_status=confirmed&payer_id=M37R97LZ8UPFG&tax=0.00&address_street=1+Main+St&payment_date=09%3A17%3A12+Mar+29%2C+2020+PDT&payment_status=Completed&charset=windows-1252&address_zip=95131&first_name=John&mc_fee=0.88&address_country_code=US&address_name=John+Doe&notify_version=3.9&custom=&payer_status=verified&business=sb-nbux41255345%40business.example.com&address_country=United+States&address_city=San+Jose&quantity=1&verify_sign=AvjnuP74.LlXuMFrpTQyHdZSoS7cAO2M95bQ1-4sQY8uLs7m-LJvZYOf&payer_email=sb-6qnmv1243052%40personal.example.com&txn_id=6T931955K3731900J&payment_type=instant&last_name=Doe&address_state=CA&receiver_email=sb-nbux41255345%40business.example.com&payment_fee=0.88&shipping_discount=0.00&insurance_amount=0.00&receiver_id=P3J43KLAR2HK4&txn_type=web_accept&item_name=Test+HDD+60+Day&discount=0.00&mc_currency=USD&item_number=&residence_country=US&test_ipn=1&shipping_method=Default&transaction_subject=&payment_gross=20.00&shipping=0.00&ipn_track_id=e38b432e0aeac]

This is my reply to acknowledge receipt, which is working:

[HTTP/1.1 200 OK

]

This is the message I am sending to ipnpb.sandbox.paypal.com. It has "cmd=_notify-validate&" prefixed to the message:

[POST /cgi-bin/webscr HTTP/1.1
user-agent: My Custom User Agent
content-type: application/x-www-form-urlencoded
content-length: 1058
host: ipnpb.sandbox.paypal.com
Connection: close

cmd=_notify-validate&mc_gross=20.00&protection_eligibility=Eligible&address_status=confirmed&payer_id=M37R97LZ8UPFG&tax=0.00&address_street=1+Main+St&payment_date=09%3A17%3A12+Mar+29%2C+2020+PDT&payment_status=Completed&charset=windows-1252&address_zip=95131&first_name=John&mc_fee=0.88&address_country_code=US&address_name=John+Doe&notify_version=3.9&custom=&payer_status=verified&business=sb-nbux41255345%40business.example.com&address_country=United+States&address_city=San+Jose&quantity=1&verify_sign=AvjnuP74.LlXuMFrpTQyHdZSoS7cAO2M95bQ1-4sQY8uLs7m-LJvZYOf&payer_email=sb-6qnmv1243052%40personal.example.com&txn_id=6T931955K3731900J&payment_type=instant&last_name=Doe&address_state=CA&receiver_email=sb-nbux41255345%40business.example.com&payment_fee=0.88&shipping_discount=0.00&insurance_amount=0.00&receiver_id=P3J43KLAR2HK4&txn_type=web_accept&item_name=Test+HDD+60+Day&discount=0.00&mc_currency=USD&item_number=&residence_country=US&test_ipn=1&shipping_method=Default&transaction_subject=&payment_gross=20.00&shipping=0.00&ipn_track_id=e38b432e0aeac]

This is the reply, which should be either VERIFIED or INVALID, but I get this instead:

[HTTP/1.1 200 OK
Date: Sun, 29 Mar 2020 16:17:19 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: c9MWDuvPtT9GIMyPc3jwol1VSlO=p6SpPIsCbJCqZIQkcsVD-Bfzd_Tg7Jsd9fWm2_ybIX11gXY4xDO-KT2TL_YOksGsgQZfQX5c-VxEk110gEBJaMfkgajY70FbBcNZyA2RHo-PaoBukkg_XxyrZCTkbaMMiPAUjpErGHmNvOkNKzGRd57hPn1OA5yZmkCh5h5M3oJxrOmMCvaVTxT9uo4fL_XvTZ36OD5JdikAjfrhX3m22j2HUcTdC9J_tPlNNrL1C8u_3erwnLQexUIuhokpqOh4g57xbn55aQNwbuL1BrbyZLDNF2prIo809x0Hf83_qbZCbl7bH6TH-247zkqpxcTG-FpY3SXK7Ohj2CaMcvi267rPYY-j8fFx8x6BhOJDM_rcyghsRE596_CiggEZje2QGOoY6OpIMPZxTt7Xc3gOSvRp_eZqF0DihRpeAfkemeAYsn6LcqWYZSqgyC4; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: cookie_check=yes; expires=Wed, 27-Mar-2030 16:17:20 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: navcmd=_notify-validate; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: navlns=0.0; expires=Tue, 29-Ma[Removed. Phone #s not permitted]GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: Apache=10.72.108.11.1585498639255869; path=/; expires=Tue, 22-Mar-50 16:17:19 GMT
Vary: Accept-Encoding,User-Agent
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

8
]

So what am I doing wrong?

[maximus57sd]

So I have been experimenting with this, and I think the PayPal response is broken. The documentation claims the following:

PayPal sends a single word back - either VERIFIED (if the message matches the original) or INVALID (if the message does not match the original).

Instead, I just get back a 200 OK response if I have “cmd=_notify-validate&” prefixed to the message. If I don’t have that prefixed to the message, I get a 302 message, and if I alter that prefix I get a 404 message. But I can alter a byte of the message and still get the 200 OK response, which means it is not validating the message as the documentation would indicate.

So is the PayPal IPN documentation incorrect? Or is the sandbox broken? Or am I doing something wrong? My testing would indicate to me that I am doing things correctly, but not getting the correct response.

[maximus57sd]

So if I use ipnpb.paypal.com I do get the message content of INVALID, and when I did a real live transaction I got VERIFIED. So the sandbox reply is broken. What good is the sandbox if it doesn't work right? So frustrating to have wasted so much time on this. But at least I know that I AM doing things correctly, and it is the PayPal sandbox that is not working. I am not marking any solution because it is broke. I am a bit disappointed that no one replied to say it was broke.