CODEWITHSUNDEEP
c#asp.netssl-certificatestripe-payments
Computer
Computer

Reputation: 2227

Secure Stripe Payment

I'm running a Stripe test payment on an ASP Net site. When the user is ready to pay they are FORWARDED to their gateway to collect card details.

Once they complete a successful payment they are returned to the success URL i set with the {SESSION_ID} variable alongside the URL i.e. www.example.com/success?session_id{Session_ID}.

I then process the payment by getting the session first

StripeConfiguration.ApiKey = "sk_test_123";

var service = new SessionService();
Checkout.Session sess service.Get("cs_test_4561");

I then find the payment from my database using the session id i saved and passed when the user checked out.

My concern is that through a web sniffer tool the Session ID can be picked up and you can pass that manually to the successURL.

I can add HTTPS to the site but is there anything else i could do to make this a little more difficult i.e. expire the Session ID after some time or have a value from Strip to confirm the payment is successful?

Edit 1:

My code behind to set the SessionCreateOptions

 var options = new SessionCreateOptions
            {
                PaymentMethodTypes = new List<string> { "card", },
                LineItems = GetItems(),
                SuccessUrl = "www.example.com/success?session_id={CHECKOUT_SESSION_ID}",
                CancelUrl = "www.example.com/cancel",

                PaymentIntentData = new SessionPaymentIntentDataOptions
                {
                    Metadata = new Dictionary<string, string>{
                        {"orderID","123"}
                    }
                },
                Mode="payment",
            };
 var service = new SessionService();
 Session session = service.Create(options);

When the user is returned back to the success page, i run this code to get the session i run the above code to get the Session but payment_intent is null if i type sess.PaymentIntent

Upvotes: 1

Views: 583

Answers (1)

taintedzodiac
taintedzodiac

Reputation: 2908

When you retrieve the CheckoutSession by its id, you should check its payment_intent to verify that it shows status: succeeded. That shows that the payment went through without issue.

More details on the entire process here: https://stripe.com/docs/payments/checkout/fulfillment

Upvotes: 1

Related Questions