ok, i think i’m getting it as far as endpoints: essentially, the invoice.js can route post requests to the router.post endpoint (endpoint being the submit payment page in this case), and it can route anything with the invoice/{invoice id} in the http to the get method (which is the invoice.jade file).
as to filip’s point:
in this video (https://academy.moralis.io/lessons/improving-payment-verification-with-webhooks-part-1-theory) from 1:25 to 1:50, he describes this issue, which i think i understand as “[anyone can copy/paste the URL that invoice.jade puts up]”, but again, i’m not sure i understand all the moving parts; you were saying it’s standard to send id as get param, which i think means it’s safe enough to do this (all of which filip later says is unnecessary when using webhooks)
/* get & verify invoice. */ // i.e. get invoice/{invoiceID}
router.get('/:id', async function(req, res, next) { //REQuest, RESolve, NEXT (step??)
// payment verification
var invoiceID = req.params.id; // 'req.params.id' is coming from the input: '/:id'
client.get_invoice(invoiceID)
.then(invoice => { // check if invoice is paid, ...
if (invoice.status == "complete" || invoice.status == "paid") {
//... if so, deliver product/service ...
res.end("<html>Thank you!</html>"); // could also res.render a new page with more follow-up, but let's just end it here
}
else { //... and if no, do something about it!
res.end("<html>Hey, we want more money!</html>")
}
})
.catch(err => console.log(err))
});
does that make sense? am i misunderstanding what he’s saying in that clip, or what you’re saying about the standard practice?
my original question was basically where’s the code that allows for such a vulnerability; i figured it was within this code (if (invoice.status==“complete” || invoice.status==“paid”) or invoice.jade…
