Stripe Checkout: paid and confirmed order is set to “Cancelled” 24 hours later b

-- HikaShop version -- : 6.7.1
-- Joomla version -- : 5.4
-- Browser(s) name and version -- : Firefox 158.0


Hello,
We are testing credit card payments with Stripe Checkout (sandbox mode) in HikaShop, and we see the following problem: an order that was paid and set to “Confirmed” is later changed to “Cancelled”.
Environment

• Joomla 5.4
• HikaShop Essential 6.7.1 [2610202116]
• Stripe Checkout payment plugin, test/sandbox mode

What we see in the HikaShop order history

1. 2026-10-19 12:32 (server time): “payment notification was received with the state paid. Transaction: pi_3USFkCHwuXBczTHH15IY23nP” → status changes to Confirmed.
2. 2026-10-20 12:28 (server time): “payment notification was received with the state expired. Session: cs_test_a12wLXY3rmwSAwgxz6dMlYmkAIwcA5MGhP8z0bjuu4nJsCJAFR2goQzn20” → status changes to Cancelled.

As a result, the digital product download is blocked, because the order status no longer allows it.
What we see in the Stripe Dashboard (Events, sandbox)
The Stripe Dashboard shows CEST time, which is 2 hours ahead of the HikaShop server time. The expired session above corresponds to the event on Oct 20 at 2:28:34 PM CEST. Around each completed payment there is also a separate Checkout Session that was never paid and expired 24 hours later:

Expired session	Expired at (CEST)
cs_test_a1pu1YuDHhHUPm4EtB95UXZlElo42pCWf9EyeFn2VXwHSN867HqikxeTgR	Oct 20, 6:44 AM
cs_test_a12wLXY3rmwSAwgxz6dMlYmkAIwcA5MGhP8z0bjuu4nJsCJAFR2goQzn20	Oct 20, 2:28 PM
cs_test_a1kFcc96hOXHs33201NSMJUaBdsQwzAdrKsF673WEZ4O8Y7kMoHWO5rXuK	Oct 20, 6:03 PM

For example, the session cs_test_a1kFcc… (expired Oct 20, 6:03 PM) belongs to according to its . It was created about 1 minute before the payment completed on Oct 19 at 6:04 PM (session cs_test_a1BFWfN39…, payment pi_3USJ37HwuXBczTHH1SY9BHpk).
The expired session IDs differ from the sessions that were actually completed, so it looks like a second Checkout Session is created for the same order, and its expiry webhook sets the already confirmed order to Cancelled.
What we would like to ask

1. Does the plugin create a new Checkout Session each time the customer reaches the payment step or returns to it? (Is it possible that two sessions are created for one order even without going back and forth?)
2. How should the plugin handle
   Code:

   checkout.session.expired
   for an order that is already paid and confirmed? In our case the status is overwritten.
3. Is the correct configuration to subscribe the webhook endpoint only to
   Code:

   checkout.session.completed
   and
   Code:

   checkout.session.async_payment_succeeded
   ? Our current endpoint events: [paste here what is selected in Stripe Dashboard → Webhooks].
4. Can you recommend a fix or patch (for example, ignoring
   Code:

   expired
   for orders that are already confirmed or shipped)?

We attach screenshots of the HikaShop order history and of the Stripe Events list. We can also provide the full order ID, the webhook configuration and debug logs if needed.
Thank you for your help.
Best regards,
Dániel Metz
metzdaniel.hu

Hi,

Thank you for the detailed report, it pointed straight at the cause. You are right: since HikaShop 6.7.0, when a customer comes back to the checkout before paying, the payment page is rebuilt and the plugin opens a new Stripe Checkout Session for the same order. The first session is never paid, and Stripe sends checkout.session.expired for it 24 hours later. The plugin then treated that event as the cancellation of the order, even though the order had been paid through the other session.

This is fixed in Stripe Checkout plugin version 1.5.9: only the expiry of the order's latest session (the one stored on the order) can cancel it. The expiry of any earlier session is just written to the plugin's log and ignored. Please download the new version from your account ( www.hikashop.com/support/documentation/4...oad-your-plugin.html ) and install it over the current one in the Joomla extension manager. Product page: www.hikashop.com/marketplace/product/296-stripe-checkout.html

About your questions: yes, two sessions can exist for one order when the customer reaches the payment step again (back button, reloading the payment page, returning from Stripe's page). No patch is needed any more, and you should keep the webhook as the plugin registered it, including checkout.session.expired, which is still used to cancel an order that really expired without payment (and for the methods where the customer pays later). The orders already set to Cancelled by this behaviour have to be put back to Confirmed by hand in the back-end.