https://developer.paypal.com/docs/checkout/integrate/
I am using the above javascript code to create a button, send the customer to pay pals checkout page and get confirmation back.
When I get the confirmation back I want to trigger an Ajax command to my page that updates my MySQL database to say the purchase was successful.
However, as javascript is client side is this secure enough? I see two potential security dangers. Are these two actually a problem or is it secure?
1) Can a customer trigger the onApprove part of the code (see below) without PayPal actually sending back a genuine approval?
2) a customer altering the call to trigger my payPalConfirm() method.
The code
<script>
paypal.Buttons({
createOrder: function(data, actions) {
return actions.order.create({
purchase_units: [{
custom_id: '55',
description: "Some description",
amount: { value: ’20’}
}]
});
},
onApprove: function(data, actions) {
return actions.order.capture().then(function(details) {
console.log(details);
console.log(data);
alert("Transaction completed by order id =" + data.orderID+ " our id = " + details.purchase_units.custom_id);
payPalConfirm(details.purchase_units.custom_id); //my ajax call to change my db entry to say payment was made
});
}
}).render('#paypal-button-container');
</script>
