4 ms·
Because it is easy to forge a response from CCAvenue saying that the payment has been made The IP from which this response comes should be an indication? Not 1
by wladimir 15y ago
Because it is easy to forge a response from CCAvenue saying that the payment has been made
The IP from which this response comes should be an indication? Not 100% secure, but a useful heuristic.
- niyazpk 15y agoThe IP will be the same. See my response here: http://hackerstreet.in/item?id=6737 http://hackerstreet.in/item?id=6737
- wladimir 15y agoOuch. That indeed sounds terribly insecure. It saddens me that any organization handling money (or any kind of user authentication) does it this way. It relies 100% on "client-side" security. Even 15 years ago these kinds of things were exploited. I was thinking in terms of the Paypal API, they send an independent request from their server to your website.