Sessions and offsite payment modules

I am battling to fix a problem with an offsite-payment module and need some information as to how things are supposed to work.

After Checkout Confirmation, the user gets sent to an offsite payment gateway. If their session expires/times-out before they return, what should happen when they return:
they see the whoops expired notice, or the gateway should be calling checkout_process with their previous zenid appended to the url and it should autologin and process the order/payment?

Seriously. If the session times out, that's it. Done. Over. It's gone. The previous zenid is expired, as it should. There is no auto-login to an expired session.

Equally, if not more, important is determining why the customer is taking half an hour to make a payment, and sorting out that matter.

Thanks, that’s what I thought. It’s just something I was not sure about while I was trying to artificially test the urls being passed about to avoid using the live gateway.

The real crux is this..

1. When the payment is ok,
   customer hits “Continue” in the gateway,
   this passes the payment transaction id to a file in the shop passing the payment transaction id,
   that redirects to the checkout_process,
   the payment transaction id is checked against the db record of the transaction,
   and the order is recorded via the payment module processes correctly.
   All OK.

2. If the payment fails in the gateway,
   the customer is presented with "Continue" which takes him (unexpectedly, for most people) back to the payment options screen in the shop, via the usual payment module processes, and is shown an error message.
   Despite the error message saying “don’t go back”, if at this point,
   he presses the browser back button to go back to the gateway,
   and then "continue" again (yes people actually do this),
   he goes forward to the shop, gets order success and it is recorded as a discount coupon.

I think that this is happening because the shop doesn't know which payment module to use at this point/ the session information is not now available.

I am working with another version of this module (for osc) that has code that retrieves the session id (stored during process_button) associated with that payment transaction id and then calls checkout_process with that id appended:
Eg:

https://www.shop.com/index.php?main_page=checkout_process&zenid=5iiljnjd08ejbajhqp3k29XXX

But it doesn’t stop the false payment/order being recorded (assuming I am doing it right…!).

How should this really be handled “correctly” (in general terms….)?

I've spent an embarrassing amount of time figuring out how (almost) all of this works, all very educational of course, but I'm stuck at this point.

torvista:

I think that this is happening because the shop doesn't know which payment module to use at this point/ the session information is not now available.
Kinda.
If no payment module name is supplied, it defaults to Coupon/GV, because that's the only way to describe an order that doesn't have payment detail associated with it (which would normally only ever happen if an order is free).