Online Ticket Booking using PayPal: Prevent multiple visitors from buying same ticket

Question

I am developing an online ticketing system for events (like concerts). A basic part is a seat chart where the visitors will be presented the available seats/tickets to choose from. Once they make a selection, the system immediately tries to reserve the tickets for 10 minutes (by entering the ticket IDs into a table where ticket ID is key). Only if the reservation was succesful, a paypal button is presented to make the payment.

All this works fine. Ticket Reservation is not a problem for me. I can handle that in my system. But once paypal comes into the game, things get difficult.

The Problem: If the user for some reason spends a lot of time in Paypal (more than 10 minutes), the ticket reservation on my website will expire, allowing the tickets to be bought by another visitor, which might happen before visitor 1 makes the payment. Visitor 1 does not see any of this because he is still in paypal... At some point in time, he will manage to make the payment (e.g. after 15 minutes), which will perfectly work because paypal does not know anything about expired reservations.

In the end, I might have two visitors having paid for the same ticket/seat!

How can I prevent that from happening? How do you handle race conditions if two systems are involved and one of them is out of your control?

My thinking was: Actually a check should be made right before the payment takes place, but of course I don't have control about what happens in paypal!

I know I can use Paypal's IPN and such, but this only happens AFTER payment which is too late.

Alternatively, it would be great if paypal asked me through API to confirm a payment. Then I could say "no" in case the tickets have been sold to someone else. But I don't think this is possible with paypal.

Answer 1

I'd recommend using Express Checkout. Express Checkout allows you to control when the payment happens, because you'll fire off an API call to PayPal to actually process the payment.

The other possibility you can look into is using an authorization instead of a sale transaction. That way, if another buyer takes the seat, you can void the authorization, and the buyer won't get charged. (PayPal will probably charge you for the voided authorization, however.)

Answer 2

One solution as Matt Cole suggested is to use 'authorization' instead of 'sale'.

You can do this by setting 'intent' to 'authorize' instead of 'sale' ({intent: "authorize"}) in your calls to the Paypal API when you're creating a Paypal payment. Once the customer approves the transaction, it is up to you to authorize this transaction by capturing the payment.