PayPal/IPN - Revision history

Woozle: /* Authentication */ removed leftover text from when I had just figured it out

2009-03-02T15:06:27Z

Authentication: removed leftover text from when I had just figured it out

← Older revision		Revision as of 15:06, 2 March 2009
Line 14:		Line 14:
	==Authentication==		==Authentication==
	In order to prevent spoofing of an IPN, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made, each IPN should be authenticated before being trusted. The process works like this:		In order to prevent spoofing of an IPN, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made, each IPN should be authenticated before being trusted. The process works like this:

	~~Ah, but wait... it looks like this is how it works:~~
	* PayPal generates a '''verify_sign''' code, and includes it with the IPN data		* PayPal generates a '''verify_sign''' code, and includes it with the IPN data
	* Your server sends return post ''back to PayPal'' which includes the '''verify_sign''' data		* Your server sends return post ''back to PayPal'' which includes the '''verify_sign''' data
Line 24:		Line 22:
	Your server's return post back to PayPal ensures that PayPal is actually in the loop during this process.		Your server's return post back to PayPal ensures that PayPal is actually in the loop during this process.

	A sample ~~value~~ of '''verify_sign''':		Some sample values of '''verify_sign''':
	AiPC9BjkCyDFQXbSkoZcgqH3hpacAM9KNT3jv0YPjZMPbrIcmvcIcLHa		AiPC9BjkCyDFQXbSkoZcgqH3hpacAM9KNT3jv0YPjZMPbrIcmvcIcLHa
			A7dSYdSlxg1gCvXiSPGpzFCXqlPvAIpupa..c7qIy0mlpCpNahyX5eL7
			A1.T9PIMhr2k3PSwkHkiKBR19G59AqQHhQC02ybe8q549oTKvY0Bbhlh

	Tentatively, it looks like a modulo-62 encoded integer; with 56 digits, that means 62<sup>56</sup> (over ~~2x10~~<sup>~~100~~</sup>) possible values.		Tentatively, it looks like a modulo-64 (upper & lowercase alpha, numerics, period = 26+26+10+1=63; presumably there's another punctuation character to make it a nice, round 64) encoded integer; with 56 digits, that means 64<sup>56</sup> (over 10<sup>101</sup>) possible values.

Woozle: /* Links */ another link, but login is required

2009-03-02T02:03:38Z

Links: another link, but login is required

← Older revision		Revision as of 02:03, 2 March 2009
Line 10:		Line 10:
	* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]		* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]
	** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]		** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]
			* [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/acc/ipn-info how it works] (login required)

	==Authentication==		==Authentication==
	In order to prevent spoofing of an IPN, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made, each IPN should be authenticated before being trusted. The process works like this:		In order to prevent spoofing of an IPN, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made, each IPN should be authenticated before being trusted. The process works like this:

Woozle: how authentication works, yay

2009-02-22T21:00:22Z

how authentication works, yay

← Older revision		Revision as of 21:00, 22 February 2009
Line 10:		Line 10:
	* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]		* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]
	** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]		** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]
	==~~Notes~~==		==Authentication==
	~~Documentation on how~~ to ~~interpret the fields returned by~~ IPN ~~is generally very lacking. A key issue seems to be that of how to authenticate the data~~, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made.		In order to prevent spoofing of an IPN, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made, each IPN should be authenticated before being trusted. The process works like this:

	~~PayPal's [https://cms~~.~~paypal~~.~~com/cms_content/US/en_US/files/developer/PP_OrderMgmt_IntegrationGuide~~.~~pdf Order Management Integration Guide] suggests setting one or more "secret" variables~~ to ~~be included in~~ the ~~IPN; while~~ this ~~may provide first-order defense against spoofing~~, ~~it is not particularly safe from interception since~~ the ~~"secret" is transmitted without encryption.~~		Ah, but wait... it looks like this is how it works:
			* PayPal generates a '''verify_sign''' code, and includes it with the IPN data
			* Your server sends return post ''back to PayPal'' which includes the '''verify_sign''' data
			* PayPal checks that this is the '''verify_sign''' it sent, and returns a code to let you know the result of the check

	The ~~fields sent with~~ the ~~IPN include at least one field which seems~~ to be a ~~[[digital signature]]~~ of ~~some kind, changing for~~ each transaction, ~~which would be~~ a ~~much better level of security (especially if it uses [[public key encryption]], e~~.g. ~~an checksum~~ of ~~the IPN data and timestamp encrypted using PayPal~~'~~s private key); a sample~~:		According to the [https://cms.paypal.com/cms_content/US/en_US/files/developer/PP_OrderMgmt_IntegrationGuide.pdf Order Management Integration Guide] (OMIG), "The value of '''verify_sign''' is an encrypted string used to validate the authenticity of the transaction." The idea appears to be that this is a random string whose value is stored by PayPal at the time of generation; only PayPal knows what value is associated with each transaction, making it essentially impossible for a spoofer to generate a "valid" verify_sign value.
	~~verify_sign~~ AiPC9BjkCyDFQXbSkoZcgqH3hpacAM9KNT3jv0YPjZMPbrIcmvcIcLHa
	~~There does not appear to be any explanation of how to decode or interpret this data~~, ~~however~~.		Your server's return post back to PayPal ensures that PayPal is actually in the loop during this process.

			A sample value of '''verify_sign''':
			AiPC9BjkCyDFQXbSkoZcgqH3hpacAM9KNT3jv0YPjZMPbrIcmvcIcLHa

			Tentatively, it looks like a modulo-62 encoded integer; with 56 digits, that means 62<sup>56</sup> (over 2x10<sup>100</sup>) possible values.

Woozle: notes: authenticating

2009-02-22T19:52:56Z

notes: authenticating

← Older revision		Revision as of 19:52, 22 February 2009
Line 10:		Line 10:
	* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]		* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]
	** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]		** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]
			==Notes==
			Documentation on how to interpret the fields returned by IPN is generally very lacking. A key issue seems to be that of how to authenticate the data, i.e. determine that it definitely comes from PayPal rather than from a third party trying to fool your system into believing a payment has been made.

			PayPal's [https://cms.paypal.com/cms_content/US/en_US/files/developer/PP_OrderMgmt_IntegrationGuide.pdf Order Management Integration Guide] suggests setting one or more "secret" variables to be included in the IPN; while this may provide first-order defense against spoofing, it is not particularly safe from interception since the "secret" is transmitted without encryption.

			The fields sent with the IPN include at least one field which seems to be a [[digital signature]] of some kind, changing for each transaction, which would be a much better level of security (especially if it uses [[public key encryption]], e.g. an checksum of the IPN data and timestamp encrypted using PayPal's private key); a sample:
			verify_sign AiPC9BjkCyDFQXbSkoZcgqH3hpacAM9KNT3jv0YPjZMPbrIcmvcIcLHa
			There does not appear to be any explanation of how to decode or interpret this data, however.

Woozle: rephrase; code samples link

2009-01-03T03:28:00Z

rephrase; code samples link

← Older revision		Revision as of 03:28, 3 January 2009
Line 1:		Line 1:
	==Overview==		==Overview==
	Instant Payment Notification (IPN) is one of two methods by which a web site may retrieve payment information ~~from [[PayPal]]~~ in real-time, i.e. immediately after a payment is completed. The other method is [[../PDT\|Payment Data Transfer]] (PDT).		Instant Payment Notification (IPN) is one of two methods by which a web site may retrieve payment information, in real time (i.e. immediately after the payment is completed), resulting from a transaction conducted on [[PayPal]]'s web site. The other method is [[../PDT\|Payment Data Transfer]] (PDT).

	IPN is somewhat more reliable than PDT in that PayPal's server contacts the merchant's server directly to transmit transaction data as soon as the transaction has occurred, rather than depending on the customer's browser to convey the data.		IPN is somewhat more reliable than PDT in that PayPal's server contacts the merchant's server directly to transmit transaction data as soon as the transaction has occurred, rather than depending on the customer's browser to convey the data.

Woozle: /* Links */ sample code

2009-01-03T03:15:44Z

Links: sample code

← Older revision		Revision as of 03:15, 3 January 2009
Line 9:		Line 9:
	==Links==		==Links==
	* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]		* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]
			** [https://www.paypal.com/us/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outside sample code]

Woozle: extracted example to a subpage; link to IPN tech doc

2009-01-03T03:08:47Z

extracted example to a subpage; link to IPN tech doc

@@ Line 5: / Line 5: @@
 {{seed}}
-==Example==
+===Pages===
-Sample data passed back to the merchant's server using IPN (using the PayPal [[../Sandbox|Sandbox]], not a real transaction), as collected by [[MediaWiki/SpecialLogPost|SpecialLogPost]]:
+* [[/example]]
-===HTML form code===
+==Links==
-<xml>
+* [https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/ipn.html Order Integration: IPN]

Woozle: New page: ==Overview== Instant Payment Notification (IPN) is one of two methods by which a web site may retrieve payment information from PayPal in real-time, i.e. immediately after a payment is...

2009-01-03T01:06:50Z

New page: ==Overview== Instant Payment Notification (IPN) is one of two methods by which a web site may retrieve payment information from PayPal in real-time, i.e. immediately after a payment is...

New page

==Overview==
Instant Payment Notification (IPN) is one of two methods by which a web site may retrieve payment information from [[PayPal]] in real-time, i.e. immediately after a payment is completed. The other method is [[../PDT|Payment Data Transfer]] (PDT).

IPN is somewhat more reliable than PDT in that PayPal's server contacts the merchant's server directly to transmit transaction data as soon as the transaction has occurred, rather than depending on the customer's browser to convey the data.

{{seed}}
==Example==
Sample data passed back to the merchant's server using IPN (using the PayPal [[../Sandbox|Sandbox]], not a real transaction), as collected by [[MediaWiki/SpecialLogPost|SpecialLogPost]]:
===HTML form code===
<xml>
<form action="https://www.sandbox.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="14406">
<input type="hidden" name="custom" value="UserNameWouldGoHere">
<input type="hidden" name="invoice" value="InvoiceFieldGoesHere">
<input type="hidden" name="notify_url" value="http://wiki.vbz.net/Special:LogPost">
<input type="hidden" name="return" value="http://test.vbz.net/cgi-bin/runpl">
<input type="image" src="https://www.sandbox.paypal.com/en_US/i/btn/btn_subscribeCC_LG.gif"
border="0" name="submit" alt="">
<img alt="" border="0" src="https://www.sandbox.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>
</xml>
===IPN POSTed data===
<pre>
2009-01-01 21:58:16
REQUEST_METHOD POST
HTTP_USER_AGENT
REMOTE_ADDR 216.113.191.33
transaction_subject
payment_date 18:58:14 Jan 01, 2009 PST
txn_type subscr_payment
subscr_id S-5G6357170N2927728
last_name User
residence_country US
item_name Full Site Access - one year
payment_gross 49.00
mc_currency USD
business paypal_1230320215_biz@hypertwins.org
payment_type instant
protection_eligibility Ineligible
verify_sign AxvQhTcd4JBdIIpB5MztE755SMD7AMz0sJLKKvdDiqzSP8TKRFoLHttM
payer_status verified
test_ipn 1
payer_email paypal_1230659178_per@hypertwins.org
txn_id 17R310755W630331M
receiver_email paypal_1230320215_biz@hypertwins.org
first_name Test
invoice InvoiceFieldGoesHere
payer_id 9AAMA7CUQ8TUN
receiver_id YCRD6GWFSUZ5L
payment_status Completed
payment_fee 1.72
mc_fee 1.72
btn_id 14406
mc_gross 49.00
charset windows-1252
notify_version 2.6
2009-01-01 21:58:16
REQUEST_METHOD POST
HTTP_USER_AGENT
REMOTE_ADDR 216.113.191.33
txn_type subscr_signup
subscr_id S-5G6357170N2927728
last_name User
residence_country US
mc_currency USD
item_name Full Site Access - one year
business paypal_1230320215_biz@hypertwins.org
amount3 49.00
recurring 1
verify_sign AdXmlE88KERMphmdMG4e.jeWGlkRAcUYzJVdMfWdteAAmuWxx9bpnguV
payer_status verified
test_ipn 1
payer_email paypal_1230659178_per@hypertwins.org
first_name Test
receiver_email paypal_1230320215_biz@hypertwins.org
payer_id 9AAMA7CUQ8TUN
invoice InvoiceFieldGoesHere
reattempt 1
subscr_date 18:58:12 Jan 01, 2009 PST
btn_id 14406
charset windows-1252
notify_version 2.6
period3 1 Y
mc_amount3 49.00
</pre>
Note that IPN returns the '''invoice''' data but not the '''custom''' data.