Please see the recommendations below regarding your problem with 5006 transaction error: cannot be redirected to the provider's website. The provider did not provide a URL redirect.
The error message itself is not always completely accurate, because it is displayed when there is any problem with the response of the notification that they receive in response to their message in NotificationURL. The following is a list of various known issues that you can investigate:
1) You can confirm receipt of a transaction response with the status OK, INVALID or ERROR
2) Before writing the three fields above the Response POST object, make sure you clear the response buffer to remove the header code, comments, or HTML. Sage Pay Server expects "Status =" to be the first character of the response. If he does not see them, he processes the response as if he is an error and does not complete the transaction!
3) Your notification page should ONLY respond to the Status field, the RedirectURL field, and optionally the StatusDetail field. No other HTML, headings, comments or text should be included before or after these fields. Sage Pay Server will process all such text as an error and will not complete the transaction.
4) Regardless of status, RedirectURL must be sent that contains a valid, fully qualified URL (that is, an address starting with http: // or https: //), to the last page of the completion of your site to which Sage Pay will send your customer
5) Encoding should be like Name = Value fields separated by carriage-return-line (CRLF)
6) Your notification page on your server may be “crashing” and you should check that the notification page on your server can correctly process all messages sent by Sage Pay (OK, ABORT, NOTAUTHED, REJECTED, PENDING and ERROR).
7). You should send OK in all cases when there are no errors when checking POST messages, therefore, even if Sage Pay sends you the status ABORT or NOTAUTHED, you should answer OK and RedirectURL, which points to the page informing the client that the transaction is not ended.
8) The Sage Pay gateway operates on a variety of fixed IP addresses, and they usually use separate IP addresses to respond to all transaction requests.
Verify that all of the following IP addresses are allowed on your server or firewall:
For outgoing traffic to our gateway:
195.170.169.9 - live.sagepay.com 195.170.169.8 - test.sagepay.com
For incoming traffic, you only need to assign IP whitelists if you use SERVER, as this is the only solution that triggers callbacks. You do not need to apply this for our FORM and DIRECT integration. The IP addresses we will call back from are:
195.170.169.14 195.170.169.18 195.170.169.15
The subnet mask used by Sage Pay is 255.255.255.000.
Make sure that your firewalls allow access to outgoing port 443 (only HTTPS!) And incoming ports 443 (and an additional 80 HTTP) for communication with our servers (in Simulator / Test / Live). However, there is always the opportunity to change that. Sage Pay belongs to the entire range 195.170.169.0/255 (256 IP).
9) Do you correctly execute the transaction in your database using the "SecurityKey, which we sent to your notification page using NextURL
10) If the MD5 signatures are consistent, your Script notification should respond with OK status and a redirect to URL indicating either the order completion page (if the status was ok) or the corresponding order failure page (if the status is UNLAWFUL or ERROR). You may wish that ABORT messages redirect the customer to the page, providing them with alternative payment methods, or ask why they decided to cancel. If the signatures do not match, you must make sure that your code rebuilds the message correctly, and if you are sure that it is, INVALID and RedirectURL should be sent to all such messages pointing to the failure page.