3
\$\begingroup\$

I am learning to use the new API version of Paypal, and I have some doubts.

Note: I've tried this on https://www.sandbox.paypal.com and it works, I have not done the tests on Live.

onApprove:

I need to send additional personalized data to Paypal, and once the user makes the payment, I return to a URL on my server, and then retrieve the data I sent.

Paypal uses fetch() to do to specify the URL and a Json object called headers, there I am adding the additional value called user_ID that I need to recover.

I am using the PHP function getallheaders(), to retrieve user_ID, which I have specified.

My questions are:

  1. Is this a correct way to send personalized data to PayPal and then be recovered?
  2. It is safe to use getallheaders(), I understand that the headers can be modified before being sent, is there any possibility that these can be altered?
  3. Using $_SERVER['HTTP_REFERER'], to detect that the referred website is from Paypal, is this still safe or difficult to break?
  4. Would this be a secure way to integrate Paypal Checkout?
  5. Any recommendation that can give me, please.

I would greatly appreciate your help.

<!DOCTYPE html>

<head>
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
</head>

<body>


    <input type="text" id="price" value="100.00">
  <input type="hidden" id="user_id" value="15">

    <div id="paypal-button-container"></div>

    <script src="https://www.paypal.com/sdk/js?client-id=HERE_CLIENT_ID&currency=USD"></script>

    <script>
    paypal.Buttons({
    createOrder: function(data, actions) {
      return actions.order.create({
        purchase_units: [{
          amount: {
            value: document.getElementById("price").value
          }
        }]
      });
    },
    onApprove: function(data, actions) {
      return actions.order.capture().then(function(details) {
        alert('Transaction completed by ' + details.payer.name.given_name);
        // Call your server to save the transaction
        return fetch('https://my-domain.com/payment-from-paypal.php', {
          method: 'post',
          headers: {
            'content-type': 'application/json',
            'user_ID': document.getElementById("user_id").value
          },
          body: JSON.stringify({
            orderID: data.orderID
          })
        });
      });
    }
  }).render('#paypal-button-container');

  </script>
</body>
\$\endgroup\$
3
  • \$\begingroup\$ I don't see a great deal of php in your question. \$\endgroup\$
    – mickmackusa
    Commented Jul 9, 2019 at 7:14
  • \$\begingroup\$ PHP is the example that I also want to see, how can I consume the PHP REST API to obtain data related to a transaction, in all Paypal examples use CURL, does another PHP alternative exist without using CURL? For example, once the transaction has been made or the product has been purchased, with the Paypal token, we can obtain the data that was sent, including the personalized ones. \$\endgroup\$
    – Learning and sharing
    Commented Jul 10, 2019 at 4:10
  • 2
    \$\begingroup\$ When you tag a question with php, I expect to see php code to review. \$\endgroup\$
    – mickmackusa
    Commented Jul 10, 2019 at 4:13

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.