I'm working on a payment processing website that will function like PayPal does on many e-commerce websites. The idea is for the customer to fill their shopping cart and click checkout, then be directed to the payment page on a secure site. After the payment page processes the payment, it directs the customer back to the original website. So far, I think I'm ok up to the point of receiving the payment, but what mechanism do sites like PayPal use to allow the original website to verify whether the payment was successfully received?
My Current Process:
- Customer click's checkout
- Store cart items as a pending order in database
- Post merchant ID, payment amount, the return URL, etc. to secure payment page. This uses SSL and I have also posted a hash of the other posted values to ensure they are not tampered with in transit.
- Customer enters card info and clicks "Pay"
- Secure site redirects to the specified return URL with a query string of relevant transaction information including a flag indicating success or failure.
For the last step, the original site needs to be sure the request came from the payment site so that a user can't just navigate to that URL, providing the query string themselves, to complete an order. I currently have the same hashing mechanism in place to make sure the query string variables are not tampered with. It is very crude. I append the variables into one long string and then append a shared secret key to the end, hash that whole string, send it. The receiving end does the same thing and compares the hashes.