How to avoid GET parameter spoofing?

Question

PHP

Good afternoon! There is a site where payment is linked to Yandex Money. After a successful payment, a redirect occurs to the controller (I use the Yii2 framework), which records through the model that the order has been paid. Parameters are passed to it via GET. Well, they can be changed. How to avoid it? Or maybe I'm doing it all wrong?

Answer 1

After a successful payment, a redirect occurs to the controller (I use the Yii2 framework), which records through the model that the order has been paid.

So there, before the redirect, there is a post request to avisoURL , and here it is possible to check everything and write it down, in no case should you do this when redirecting. Or give a link to the project, I will be a regular customer)))

Answer 2

If the request came from a payment system, then there should be a hash field. How exactly it is formed, see the documentation from the payment gateway you are using, but there, in addition to the parameters, a secret word is always used, known only to you and the payment gateway, so if you change at least one parameter or at least one character in the secret word, then the hash will not converge and request can be considered fake.