Agent WranglersAbuse and limits Required
Confirm payments on the server
Mark an order as paid only after the payment provider confirms it through a signed webhook or its API. Never trust the return to your success page.
How to do it
Anyone can open the success address without paying. Verify the webhook's signature with the provider's library, using the raw request body. Check the amount and currency against the order, and handle each event ID once. Show "payment pending" until the webhook arrives. See also let provider events move the order.
How to check
Open the success address of an unpaid test order directly. The order stays unpaid. Send a webhook with a wrong signature. It is refused and nothing changes.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/confirm-payment-server-side.