Currently, there is a risk of a user starting an external swish checkout, then cancelling their order (or via timeout), and then submitting their payment on Swish. We cannot completely eliminate this, but we can minimize this risk by sending a cancellation to Swish ref. The risk is not as high with Stripe (since the payment window closes on timeout), but we should do something similar anyways.
PS. We should probably have better logging around these callbacks.
Currently, there is a risk of a user starting an external swish checkout, then cancelling their order (or via timeout), and then submitting their payment on Swish. We cannot completely eliminate this, but we can minimize this risk by sending a cancellation to Swish ref. The risk is not as high with Stripe (since the payment window closes on timeout), but we should do something similar anyways.
PS. We should probably have better logging around these callbacks.