Implement _notify-validate

[sudiptpa]

Implement _notify-validate

[sudiptpa]

@JFOC i will have a look at it. Thanks for the feedback.

[JFOC]

hi,
still planning to adding this ?

[sudiptpa]

Oh sorry, been a lot busy, i've noted this to look at the coming weekend !

[sudiptpa]

Hey @JFOC

I went through this issue today and my feedback to you are below.

1. This package already follow the _notify-validate rules here, based on this docs from PayPal here

See what PayPal docs says.

The IPN message authentication protocol consists of four steps:

• PayPal HTTPS POSTs an IPN message to your listener that notifies it of an event.
• Your listener returns an empty HTTP 200 response to PayPal.
• Your listener HTTPS POSTs the complete, unaltered message back to PayPal; the message must contain the same fields (in the same order) as the original message and be encoded in the same way as the original message.
• PayPal sends a single word back - either VERIFIED (if the message matches the original) or INVALID (if the message does not match the original).

Important:

• Every IPN message you receive from PayPal includes a User-Agent HTTPS request header whose value is PayPal IPN ( https://www.paypal.com/ipn ). Do not use this header to verify that an IPN really came from PayPal and has not been tampered with. Rather, to verify these things, you must use the IPN authentication protocol outlined above.

• PayPal expects to receive a response to an IPN message within 30 seconds. Consequently, your listener must not perform time-consuming operations (such as updating a database) before responding to an IPN.

After PayPal verifies an IPN, your listener or administrative software should make these additional checks:

• Verify that you are the intended recipient of the IPN message. To do this, check the receiver_email email address in the message. This check prevents another merchant from accidentally or intentionally using your listener.

• Verify that the IPN is not a duplicate. To do this, save the transaction ID and last payment status in each IPN message in a database and verify that the current IPN's values for these fields are not already in this database.

Kindly follow the given PayPal IPN docs, this package follows all standard defined in the docs.

It is really a developer job to do additional security checks with the IPN messages sent on the listner.