4 ms·

Looking at the docs (https://docs.bolt.com/v1/docs/step-2-load-bolt-checkout https://docs.bolt.com/v1/docs/step-2-load-bolt-checkout) it instructs the reader: "

Looking at the docs (https://docs.bolt.com/v1/docs/step-2-load-bolt-checkout https://docs.bolt.com/v1/docs/step-2-load-bolt-checkout) it instructs the reader: "The onSuccess method will be called when Bolt successfully processes a transaction. This can be used as a way to create the order (...)". This opens up a massive security hole if the merchant is making decisions based on this method being called client-side, right? What prevents a malicious actor from calling that method directly and thus simulating an order as far as the merchant is concerned?

thephyber 9y ago
> This opens up a massive security hole Have you considered that discussing API design decisions regarding security in a public forum is a bad decision of your own? After literally 10 seconds on the site, I found this: https://bolt.com/security https://bolt.com/security
- si1entstill 9y ago
  "Security hole" may have been poor word choice on my part. "Potentially unsafe process recommendation" would probably be a more apt description. My concern is not a security issue or vulnerability on their site or service. I am concerned that a processes they are recommending may not be safe, and if I am incorrect (I still feel that I may be missing something), I feel that a response may be insightful to others.
- Keeeeeeeks 9y ago
  Nah, his post is what Hacker News is for; if the company and their CEO is announcing coming out of stealth mode and answering responses, it's worth that guy vocalizing that potential vulnerability. Your post tried to chastise him for calling out a vulnerability, and then tried to shame him for not quietly emailing their security team. Chances are if someone were a bad actor they would have: A) seen that themselves outside of his message, or B) Found out through sheer luck and brute force If anything, the poster mentioning it invites the team to fix it before someone exploits it. It's worse to blunder on a hole someone told you was 1.5km down the road, so hopefully they either address it or fix it
ComputerGuru 9y ago
I imagine there is an HMAC or similar that can be verified?
rbres 9y ago
Thanks for pointing this out. It was a shortcut for some very early beta testers. We've since removed it from the docs. We have a server-based webhooks to create orders which is how we do secure order creation. Bolt provides a webhook (Bolt server -> merchant server) and REST APIs (merchant server -> Bolt server) to exchange data (including transaction details) through a secure channel. Appreciate it again.

thephyber 9y ago

> This opens up a massive security hole Have you considered that discussing API design decisions regarding security in a public forum is a bad decision of your own? After literally 10 seconds on the site, I found this: https://bolt.com/security https://bolt.com/security

si1entstill 9y ago
"Security hole" may have been poor word choice on my part. "Potentially unsafe process recommendation" would probably be a more apt description. My concern is not a security issue or vulnerability on their site or service. I am concerned that a processes they are recommending may not be safe, and if I am incorrect (I still feel that I may be missing something), I feel that a response may be insightful to others.
Keeeeeeeks 9y ago
Nah, his post is what Hacker News is for; if the company and their CEO is announcing coming out of stealth mode and answering responses, it's worth that guy vocalizing that potential vulnerability. Your post tried to chastise him for calling out a vulnerability, and then tried to shame him for not quietly emailing their security team. Chances are if someone were a bad actor they would have: A) seen that themselves outside of his message, or B) Found out through sheer luck and brute force If anything, the poster mentioning it invites the team to fix it before someone exploits it. It's worse to blunder on a hole someone told you was 1.5km down the road, so hopefully they either address it or fix it

ComputerGuru 9y ago

I imagine there is an HMAC or similar that can be verified?

rbres 9y ago

Thanks for pointing this out. It was a shortcut for some very early beta testers. We've since removed it from the docs. We have a server-based webhooks to create orders which is how we do secure order creation. Bolt provides a webhook (Bolt server -> merchant server) and REST APIs (merchant server -> Bolt server) to exchange data (including transaction details) through a secure channel. Appreciate it again.