如何避免 ASP.NET Core MVC 中的 paypal 安全漏洞

Question

I have implemented paypal payment in an ASP.NET Core MVC application, which involves collecting fees from students for their academic year.

Currently I have used sandbox environment and I have almost completed the development using this support document.

But I'm stuck with a problem: all the GUID, PAYMENTID, TOKEN values are visible in URL itself after the payment is successful or failed (see screenshot shown here):

I am bit worried if this could lead to security breach, how to fix this?

Kindly share your knowledge on how to hide these information and protect payment related details.

Thanks for your time.

Answer 1

You may use JS SDK for handling Checkout at client side. Together with REST API, payment information could be passed to backend for handling.

You may follow this tutorial from PayPal.

Please note that both Payments v1 API and PayPal .NET SDK are deprecated.

A direct REST API integration is recommended. Review the docs on authorization for authenticating requests with the REST API.

According to the Deprecation Notice for REST API SDK for Dotnet V2