Re: Paypal and "going root"

Dave Page wrote:
> Kenneth Downs wrote:
>
>> The last one left that I have is the sticky issue of a paypal IPN
>> transaction coming in. I believe it applies generally to financial
>> transactions. The user is sent by our application to the Paypal site.
>> When they pay, paypal sends a POST with various information that we
>> need. The user does not see this, it is behind the scenes. The POST
>> request must run as an anonymous user because I have no state
>> whatsoever. But the request must also commit financial data. This
>> creates a vulnerability, at least in theory. There are fields contained
>> in the transaction meant to allow confirmation and prevent fraud, but I
>> just don't like that idea of running anonymously and committing
>> financial data.
>>
>> In this case it seems creating a stored procedure will not automatically
>> help, as then we just execute the SP anonymously, and it strikes me as
>> no different.
>>
>> Has anybody pondered this and come up with anything?
>>
>>
>
> In response to the incoming IPN you can create a connection back to the
> paypal server to validate it. Iirc, you basically just send the entire
> request back again and it returns 'VERIFIED'.
>

Ah yes, that's true, thanks for the wake-up on that one.

--
Kenneth Downs
Secure Data Software, Inc.
www.secdat.com www.andromeda-project.org
631-689-7200 Fax: 631-689-0527
cell: 631-379-0010