Stripe Checkout – Expired webhook cancels an already paid and confirmed HikaShop

-- HikaShop version -- : HikaShop Essential 6.7.1
-- Joomla version -- : Joomla 5.4
-- PHP version -- : PHP 8.3.36
-- Browser(s) name and version -- : Vivaldi 8.2.4133.96
-- Error-message(debug-mod must be tuned on) -- : payment notification was received with the state paid

Title: Stripe Checkout – Expired webhook cancels an already paid and confirmed HikaShop order
Hello,
I am experiencing a problem with Stripe Checkout in HikaShop.
The payment is completed successfully, Stripe confirms the transaction, and HikaShop correctly changes the order status to Confirmed.
However, approximately 24 hours later, Stripe sends another webhook notification with the status . HikaShop processes this notification and automatically changes the already paid order status to Cancelled.
Example from my order logs:

• October 19, 2026, 12:32 (server time): successful payment, order status: Confirmed.
• Transaction ID:
  Code:

  pi_3USFkCHwuXBczTHH15IY23nP
• October 20, 2026, 12:28 (server time): HikaShop receives an
  Code:

  expired
  notification and changes the order status to Cancelled.
• Stripe event:
  Code:

  checkout.session.expired
  (October 20, 2026, 14:28:34 CEST).

I also noticed in the Stripe Dashboard that two different Checkout Sessions sometimes appear to be created for the same order. One is successfully paid, while the other remains unpaid and expires after approximately 24 hours.
Could this be the reason why the expired webhook incorrectly cancels an already paid order?
There are two additional problems:

1. When the order is cancelled, HikaShop also increases the product stock quantity by one.
2. Since I sell digital products, the customer loses access to the download, even though the payment was successful.

My questions:

• Why are two different Stripe Checkout Sessions created for the same order?
• How can I prevent an
  Code:

  expired
  webhook from changing an already paid and confirmed order to Cancelled?
• How can I ensure that the stock quantity and the customer's download permissions remain unchanged in this situation?

Thank you in advance for your help!

Hi,

The second Checkout Session is created when the customer comes back to the checkout before paying (for example with the back button from the Stripe page, or by reloading the last checkout step): the payment page is rebuilt and the Stripe Checkout plugin opens a new session for the same order. The customer pays with one of them, the other one stays unpaid and Stripe expires it about 24 hours later. Older versions of the plugin processed that expiry notification as a failed payment for the order and set it to Cancelled, even though it had been paid with the other session.

This is fixed in the Stripe Checkout plugin: version 1.5.8 no longer lets an expiry or failure notification cancel a confirmed order, and version 1.5.9 ignores the expiry of any session other than the one the order was paid with (or the latest one opened for it), so an order you have already set to Shipped is not touched either. Please update the plugin to 1.5.9 (or newer) by installing it over the current one, with Joomla's updater or with the download from your account on our website: www.hikashop.com/marketplace/product/296-stripe-checkout.html Your settings are kept. You can see the installed version in System > Manage > Extensions.

For the orders that were already cancelled this way:

1. Open the order in HikaShop > Orders and set its status back to Confirmed. The customer's downloads become available again automatically, since downloads are allowed for confirmed and shipped orders.

2. Setting an order from Cancelled back to Confirmed does not take the stock again, so lower the stock of the product by the quantity of the order in its product page (one per order in your case). If a coupon was used on the order, its usage count was also lowered at the cancellation.

The second session itself is harmless: it expires on its own without charging anything, and with the updated plugin its expiry is only logged.