Implement JWS signature validation on incoming notifications - Githubissues

CommerceWeavers / SyliusTpayPlugin

MIT License

0 stars 1 forks source link

Implement JWS signature validation on incoming notifications #7

Closed jakubtobiasz closed 6 days ago

jakubtobiasz commented 1 month ago

To keep things simples, I skipped implement JWS validation in #4. This task aims to add a support for it.

Also we should check the checksum according to the @coldic3's comment https://github.com/CommerceWeavers/SyliusTPayPlugin/pull/12#discussion_r1745091575.

Small wins 🏆

[x] Notifications containing a valid JWS signature are passed correctly
[x] Notifications containing an invalid JWS signature are rejected
[x] Certificate obtained from JWS is cached locally
[x] Validate request checksum

Ref:

The codebase of the PHPers 2024
https://docs-api.tpay.com/en/webhooks/#security