FloPay Backend Changelog

v1.10.37 - Malformed checkout session tokens get 401 instead of a server error #

A checkout request whose session token is not a valid token is now answered with 401 Unauthorized, the same response as a wrong token, instead of a 500 server error. No integration action is needed.

A checkout request that carried a malformed X-Checkout-Session-Token, for example arbitrary text or a cut-off token, could fail with 500 Internal Server Error. It is now rejected with 401 Unauthorized before the session is looked up.

What changed

• A session token that is not a well-formed token gets 401 Unauthorized with the same response body as a wrong token.
• A valid token is checked exactly as before: the matching token is accepted, a wrong token gets 401, and an unknown session gets 404.
• A missing token still gets 401, as before.

Why it matters

• Integrations can treat a malformed token like any other rejected token, with no retries on a server error that a retry would never fix.

Developer notes

• Send X-Checkout-Session-Token exactly as Flopay issued it. A different spelling of the same value, such as without its hyphens or wrapped in braces, is now also answered with 401. Tokens issued by Flopay are not affected.
• No endpoint, request or response field, or SDK export changed. The only status change is 500 to 401 for a malformed token.
• No merchant action is required. This release contains no breaking changes.