New Paypal IPN address for HTTPS

Could you provide a direct link to the PayPal document please, so we can verify the complete URL for the new IPN server - all that text tells me is the domain.

Ubercart has always used HTTPS for IPN, so we have no need for a configurable URL to support non-HTTPS connections. We will just switch to the new URL. Marking this as a task to complete before PayPal turns off the old URL next year ...

Patches are welcome, if you'd like to help out.

Paypal recommends to use "ipnpb.paypal.com" instead of "paypal.com" when using HTTPS.

PayPal documentation still shows the old URLs, so before we change anything here I really need a link to change notice or whatever new documentation PayPal has showing that this is what we should do.

Some documentation about this is here: https://www.paypal-knowledge.com/infocenter/index?page=content&widgetvie...

However, I think we can do nothing for now. PayPal "strongly recommends the use of ipnpb.paypal.com going forward" but it seems that www.paypal.com will still accept HTTPS IPNs for the foreseeable future.

Yeah, I saw that, but it's not clear to me that "paypal-knowledge.com" and "paypal-techsupport.com" are legitimate PayPal-owned domains.

And what I consider to be the official site for developer documentation, developer.paypal.com, does NOT have that new URL anywhere - all the documentation and examples on developer.paypal.com has the same URL as we use.

Does this help? https://www.paypal-notice.com/en/IPN-Verification-Postback-to-HTTPS/

This looks like a legitimate PayPal-owned domain:

$ whois -h whois.markmonitor.com paypal-notice.com
Domain Name: paypal-notice.com
Registry Domain ID: 2002991382_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2017-12-09T04:00:05-0800
Creation Date: 2016-02-15T08:30:52-0800
Registrar Registration Expiration Date: 2019-02-15T08:30:52-0800
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: PayPal Inc.
Registrant Street: 2211 North First Street,
Registrant City: San Jose
Registrant State/Province: CA
Registrant Postal Code: 95131
Registrant Country: US
Registrant Phone: +1.8882211161
Registrant Phone Ext:
Registrant Fax: +1.4025375774
Registrant Fax Ext:
Registrant Email: hostmaster@paypal.com
Registry Admin ID:
Admin Name: Domain Administrator
Admin Organization: PayPal Inc.
Admin Street: 2211 North First Street,
Admin City: San Jose
Admin State/Province: CA
Admin Postal Code: 95131
Admin Country: US
Admin Phone: +1.8882211161
Admin Phone Ext:
Admin Fax: +1.4025375774
Admin Fax Ext:
Admin Email: hostmaster@paypal.com
Registry Tech ID:
Tech Name: Domain Administrator
Tech Organization: PayPal Inc.
Tech Street: 2211 North First Street,
Tech City: San Jose
Tech State/Province: CA
Tech Postal Code: 95131
Tech Country: US
Tech Phone: +1.8882211161
Tech Phone Ext:
Tech Fax: +1.4025375774
Tech Fax Ext:
Tech Email: hostmaster@paypal.com
Name Server: ns2.p57.dynect.net
Name Server: pdns100.ultradns.com
Name Server: ns1.p57.dynect.net
Name Server: pdns100.ultradns.net
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2017-12-21T15:25:39-0800 <<<

The Data in MarkMonitor.com's WHOIS database is provided by MarkMonitor.com for
information purposes, and to assist persons in obtaining information about or
related to a domain name registration record. MarkMonitor.com does not guarantee
its accuracy. By submitting a WHOIS query, you agree that you will use this Data
only for lawful purposes and that, under no circumstances will you use this Data to:
(1) allow, enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via e-mail (spam); or
(2) enable high volume, automated, electronic processes that apply to
MarkMonitor.com (or its systems).
MarkMonitor.com reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services

Visit MarkMonitor at http://www.markmonitor.com
Contact us at +1.8007459229
In Europe, at +44.02032062220

For more information on Whois status codes, please visit
https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en

The PayPal developer documentation is now using ipnpb.paypal.com instead of www.paypal.com:

https://developer.paypal.com/docs/classic/ipn/ht_ipn/

https://developer.paypal.com/docs/classic/ipn/integration-guide/IPNTesting/

If this ever becomes a real problem for anyone and no fix is provided, the code can be changed manually. Look at lines 72 and 75 in file uc_paypal.pages.inc. Change this:

 if (variable_get('uc_paypal_wpp_server', '') == 'https://api-3t.paypal.com/nvp') {
    $host = 'https://www.paypal.com/cgi-bin/webscr';
  }
  else {
    $host = variable_get('uc_paypal_wps_server', 'https://www.sandbox.paypal.com/cgi-bin/webscr');
  }

to this:

 if (variable_get('uc_paypal_wpp_server', '') == 'https://api-3t.paypal.com/nvp') {
    $host = 'https://ipnpb.paypal.com/cgi-bin/webscr';
  }
  else {
    $host = variable_get('uc_paypal_wps_server', 'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr');
  }

7.x patch attached.

I've been running my D7 installation with the patch I shared in #7 for about one month. It's working just fine with no unintended side-effects.

Patch tested. Works on my fairly vanilla D8 site.

OK, I've checked out the URL provided by @sah62 in #7 and confirmed that the official PayPal documentation now shows the new recommended URLs.

But to be perfectly clear, it also shows:

 Valid Postback URLs (HTTPS):
Live:
    https://ipnpb.paypal.com/cgi-bin/webscr 
    https://www.paypal.com/cgi-bin/webscr 

Sandbox:
    https://ipnpb.sandbox.paypal.com/cgi-bin/webscr 
    https://www.sandbox.paypal.com/cgi-bin/webscr 

We currently use the second form of this URL, and going forward this will still be supported.

The change notice mentioned in the original post has been put off several times, and is now scheduled to go into effect in June 2018, more than a year after the original notice.

And specifically, the change is that the www... URLs for IPN postback will no longer accept HTTP as of that date. UBERCART HAS NEVER USED HTTP FOR IPN POSTBACKS. Therefore this is a change that does not affect us at all.

However, PayPal is now recommending, but not requiring, the ipnpb... URLs. So we should switch to that.

The reason this has remained open so long is that:
1) There was no official PayPal documentation showing the "new" URLs until recently.
2) The "new" URLs are not required, and the "old" URLs are not going away, so it would be irresponsible to change Ubercart without an actual patch that had been tested by actual PayPal users. That has now occurred, so now we can proceed with the change.

Hello, I found some errors
After set up ubercart and wps, variable "uc_paypal_wps_server" stores URL https://www.sandbox.paypal.com/cgi-bin/webscr for sandbox or https://www.paypal.com/cgi-bin/webscr for live, so this variable will not equal new URL for postback IPN. And when paypal will not support old url for postback then will error. see code

  if (variable_get('uc_paypal_wpp_server', '') == 'https://api-3t.paypal.com/nvp') {
    $host = 'https://ipnpb.paypal.com/cgi-bin/webscr';
  }
  else {
    $host = variable_get('uc_paypal_wps_server', 'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr');
  }

I suggest to change code.

  if (variable_get('uc_paypal_wpp_server', '') == 'https://api-3t.paypal.com/nvp') {
    $host = 'https://ipnpb.paypal.com/cgi-bin/webscr';
  }
  else {
    if (variable_get('uc_paypal_wps_server') == 'https://www.paypal.com/cgi-bin/webscr') {
      $host = 'https://ipnpb.paypal.com/cgi-bin/webscr';
    }
    else {
      $host = 'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr';
    }

  }

Created patch