>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3633241. --> Reported by: [vmarchuk](https://www.drupal.org/user/306425) Related to !77 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The Accept Hosted payment form sits on the checkout review step. <code>AcceptHosted::getAcceptHostedCheckoutForm()</code> requests a new payment page token from Authorize.net and puts it in <code>drupalSettings.commerceAuthorizeNet.paymentToken</code>. The token is single-use and expires after 15 minutes.</p> <p>The checkout form is cached by the Dynamic Page Cache, though. <code>CheckoutFlowBase::buildForm()</code> applies the parent entity's and the order's cacheability to the form:</p> <pre>CacheableMetadata::createFromRenderArray($form) -&gt;addCacheableDependency($this-&gt;parentEntity) -&gt;addCacheableDependency($this-&gt;getOrder()) -&gt;applyTo($form);</pre><p>That sets a top-level <code>#cache['max-age']</code>, so <code>FormBuilder::prepareForm()</code> treats the form as having opted in to caching. It then skips making the form token uncacheable (the <code>if (!isset($form['#cache']['max-age']))</code> check). The review page becomes cacheable per user (<code>X-Drupal-Dynamic-Cache: HIT</code>), and the cached copy is only invalidated by the order's cache tags.</p> <p>When a payment is declined inside the iframe, nothing in Drupal changes: no redirect, no order save. Authorize.net removes the iframe's buttons after a decline, so the customer has to reload the page to try again. The reload serves the cached form with the token that was just used, and the iframe shows "Accept Hosted Token expired. Please retry." The customer can't pay again until something invalidates the order's cache tags, such as the next order refresh (5 minutes by default) or a change to the cart.</p> <h3 id="summary-steps-reproduce">Steps to reproduce</h3> <ol> <li>Enable the <code>dynamic_page_cache</code> module (it is on by default) and set up an Accept Hosted gateway in test mode.</li> <li>Go through checkout to the review step as an authenticated user.</li> <li>Submit a card in the iframe that gets declined. In the sandbox, a billing ZIP of 46282 does this.</li> <li>Reload the review page. The response has <code>X-Drupal-Dynamic-Cache: HIT</code> and the same <code>paymentToken</code> as before.</li> <li>Submit the card again. The iframe says "Accept Hosted Token expired. Please retry."</li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Set <code>$form['#cache']['max-age'] = 0</code> in <code>getAcceptHostedCheckoutForm()</code>, so the form holding the token is never cached and every page load gets a new token. The review page is per user and holds a form token anyway, so it loses no useful caching. With this change the response is <code>X-Drupal-Dynamic-Cache: UNCACHEABLE</code> and each load requests a new token.</p> <p>Arguably <code>CheckoutFlowBase</code> should not opt checkout forms in to caching like this, but the token is gateway-specific, so the gateway is the right place to fix it.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Review the patch.</li> <li>Add a functional test that the review step response is uncacheable and that two loads get different tokens.</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>None.</p> <h3 id="summary-api-changes">API changes</h3> <p>None.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None.</p>