Quick question about PayPal IPN Security
Posted
by Alix Axel
on Stack Overflow
See other posts from Stack Overflow
or by Alix Axel
Published on 2010-05-18T10:55:24Z
Indexed on
2010/05/18
11:00 UTC
Read the original article
Hit count: 415
PayPal IPN sends a POST request with a variable number of fields to the notify URL, in order to confirm that the POST request is legit we need to resubmit the same request along with a additional cmd=_notify-validate field to PayPal, which then replies SUCCESS or FAILURE.
My question is, why do we need to resend the request to PayPal? Wouldn't something like this work?
if (preg_match('~^(?:.+[.])?paypal[.]com$~i', gethostbyaddr($_SERVER['REQUEST_ADDR'])) > 0)
{
// request came from PayPal, it's legit.
}
Iff we can trust the server to correctly resolve IPs, I assume we can trust PayPal POST requests, no?
© Stack Overflow or respective owner
