Reputation: 1676
I am implementing Google Wallet for Digital Goods in a website, using PHP and HTML/JavaScript.
Google will wait 10 seconds for the postback.php to respond with 200/ok and to output the order ID. If that has happened, it will charge the Credit Card and call the success_handler function. After 10 seconds of no response however it will cancel the transaction and trigger the failure_handler function.
I want to protect myself from my server being slow and only want to deliver the digital good if the success_handler has been called. To prevent fraud i need to verify if the order ID was correct (because the successhandler is client side).
How do I get the order ID of the transaction into the success_handler, so that I can verify it in my system and if all matches be sure that I received the money and deliver the digital good?
Upvotes: 1
Views: 438
Reputation: 2108
As you point out, to prevent fraud, you need to check with your server that the transaction calling the success handler matches a corresponding postback call made to your server.
You will need to match the order Ids returned by the two callbacks. The order Id is part of the jwt returned in the success handler or server postback (under "response"->"orderId"):
https://developers.google.com/commerce/wallet/digital/docs/jsreference#successhandler
Upvotes: 2