I've thrown together the form as it explains on their website to send the user to Worldpay and to let them know how much to charge - that way easy...
My problem is that I am confused how to stop the payment system being subject to abuse given that it currently works like this:
1. CartId generated for user
2. User submits form to Worldpay and is diverted to their website
3. User pays using Worldpay
4. Worldpay diverts back to a success page on my website with the CartId saying they have paid
Using this approach a user could easily create an order, transfer to Worldpay, then without paying just make a call to my success page sending it the same data Worldpay would have used to show the transaction as being completed. This would make my website think they had paid, when in reality they had not.
What am I doing wrong?... Or do I have no choice other than to review the Worldpay logs for every order?! :-( :-s
2006-08-12
14:26:19
·
3 answers
·
asked by
Tim C
1
in
Computers & Internet
➔ Software