How to Form POST to Paypal from WinJS iframe Windows 8 App?

Question

I have a Windows 8 App using Javascript/HTML and within an iframe I have a Paypal form:

<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="on0" value="Pages">
<select name="os0">
    <option value="10">$1.95</option>
    <option value="25">$2.95</option>
</select>
<input type="hidden" name="currency_code" value="USD">
<input type="hidden" name="encrypted" value="[removed]">
<input type="image" src="/btn_buynow_LG.gif" border="0" name="submit" alt="">
</form>

This form works perfectly fine in all browsers, including IE10 but when submitted from within the iframe in the Windows 8 App, it will lead the user to the Paypal homepage. This usually indicates an issue with the form. I have tried hosted Paypal buttons, encrypted, un-encrypted buttons and they all exhibit the same behavior. Only when I submit this form from within the Windows 8 App does it go to the Paypal.com homepage.

I have also tried adding every URL to my manifest as allowed URLs:

<ApplicationContentUriRules>
<Rule Match="http://example.com" Type="include" />
<Rule Match="http://*.example.com" Type="include" />
<Rule Match="http://paypal.com" Type="include" />
<Rule Match="http://*.paypal.com" Type="include" />
<Rule Match="https://paypal.com" Type="include" />
<Rule Match="https://*.paypal.com" Type="include" />
</ApplicationContentUriRules>

I tried adding/removing the sandbox attribute and adding all combinations of the properties like so:

<iframe sandbox="allow-same-origin allow-top-navigation allow-forms allow-scripts allow-popups" src="http://example.com/paypalbtn.html"></iframe>

If I remove the target="_blank" then the Windows 8 App will navigate to a black screen and hang. I am forced to alt-tab and shutdown the app. I assume it's a problem with the form POST to a new window in another process.

How can I launch Paypal from within the iframe of a Windows 8 App?

Is a form POST required? I am now realizing that a form GET works.

Answer 1

Paypal will block the form POST to the new window when launched from an iframe in the Windows 8 App. The result is you see the Paypal homepage instead of the purchase order form.

I can confirm that simply switching the form method to GET and using a target="_blank" works perfectly without issue:

 <form action="https://www.paypal.com/cgi-bin/webscr" method="get" target="_blank">

Another way around this issue within the iframe is to use a standard anchor tag around text or an image and manually create the URL like so:

<a href="https://www.paypal.com/cgi-bin/webscr?custom=[custom info]&item_name=[URL encoded name]&item_number=[num]&amount=9.95&currency_code=USD&cmd=_xclick&business=[paypal email address]&return=[URL encoded URL]">Buy Now</a>

The credit for this answer goes to this page about Paypal links instead of buttons.