Support checkout session - #241
Conversation
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…egration-tests/lodash-4.18.1 Bump lodash from 4.17.23 to 4.18.1 in /Test/integration-tests
…egration-tests/max/minimatch-3.1.5 Bump minimatch from 3.1.2 to 3.1.5 in /Test/integration-tests/max
…mproved readability and maintainability
shahbaz-mehar
left a comment
shahbaz-mehar
left a comment
There was a problem hiding this comment.
Changes have been reviewed.
Removes [uuid](https://github.com/uuidjs/uuid). It's no longer used after updating ancestor dependency [cypress](https://github.com/cypress-io/cypress). These dependencies need to be updated together. Removes `uuid` Updates `cypress` from 13.1.0 to 15.15.0 - [Release notes](https://github.com/cypress-io/cypress/releases) - [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md) - [Commits](cypress-io/cypress@v13.1.0...v15.15.0) --- updated-dependencies: - dependency-name: uuid dependency-version: dependency-type: indirect - dependency-name: cypress dependency-version: 15.15.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
…egration-tests/multi-abfde44b12 Bump uuid and cypress in /Test/integration-tests
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.1 to 0.2.6. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.1...v0.2.6) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…egration-tests/min/tmp-0.2.6 Bump tmp from 0.2.1 to 0.2.6 in /Test/integration-tests/min
|
|
||
| if (empty($sessionId)) { | ||
| try { | ||
| $sessionId = 'session-' . $order->getQuoteId() . '-' . $order->getIncrementId(); |
There was a problem hiding this comment.
In Magento, Quote IDs and Increment IDs are predictable, sequential integers.
An attacker understands the sequential nature of Magento Order Increment IDs and Quote IDs. The attacker can predict the sessionId generated for other customers' checkout sessions. the attacker could potentially hijack another user's active checkout session, access sensitive payment details, or manipulate the payment state.
I think the right approach will be to hash the value with a salt, so it can't be guessed.
There was a problem hiding this comment.
@emicha I have updated this to use protect code (a unique alphanumeric token).
There was a problem hiding this comment.
@emicha , I have adjusted the session ID handling. Since Magento protect_code is generated per order and changes when a new order is created after a failed payment attempt, we now use a separate AltaPay session token linked to the quote/checkout flow.
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
| $storeCode = $order->getStore()->getCode(); | ||
| $activeTerminals = $this->getActiveTerminals($request, $storeScope, $storeCode); | ||
|
|
||
| $sessionKey = 'altapay_checkout_session_id_' . $order->getQuoteId(); |
There was a problem hiding this comment.
You are using the quoteId directly, instead of a hash.
There was a problem hiding this comment.
@emicha, the quoteID here is only used to build the internal Magento checkout-session key and is not sent to AltaPay. The value passed as AltaPay’s session_id is $sessionToken, which is generated from the SHA-256 hash of the quote ID and encoded as base64url.
…egration-tests/min/form-data-4.0.6 Bump form-data from 4.0.5 to 4.0.6 in /Test/integration-tests/min
4 participants
No description provided.