🔒 Locked

[web] PostbackURL

Started by ThreeMarks Jan 25, 2011 at 11:42 AM 5 replies 2.5k views

Original Post

Jan 25, 2011 at 11:42 AM

I'm building an application for social networking sites. I've done this before, but there's an issue I have with basic web development, of which I'm not too familar.

I'm using a virtual currency site to take payments etc. As part of the 'settings' it is required that you provide a postbackURL. Essentiall, what happens (from my understanding) is that you use HTTP GET to get information using the site's API. After success, a HTTP POST message with details about the transaction, is sent back PostbackURL.

I'm an experiecned software engineer, using C# .Net / Silverligth etc, but not so familiar with web programming.

What do I need to 'have' at the PostbackURL page? Cam this be, say, a php file that processes the returned message? How do I actually get a hold of this message using PHP, ASP or whatever?

I've done some digging on Google, but what I tend to find is articles describing postbackURL for Form controls etc. and I'm not sure if this is relevant to me. I'd be grateful if somebody could point me in the right direction. A cou;le of good articles would be nice

Thanks,
Marc.

Cygnus_X

Jan 25, 2011 at 1:55 PM

Have you ever seen a url with www.something.com/index.php?id=4

the ?id=4 is a '$_GET' variable in php

basically, you could write the following in your index.php file

global $_GET;
echo $_GET['id'];

?>

this would print the value 4 to your website

Of course, fancier operations involving database storage could be done here... but thats another topic.

leiavoia

Jan 26, 2011 at 5:10 AM

Does the API provide any other connection options? It seems hacky to do it this way. It would be better if the whole thing were just a regular HTTP POST. You send something to the server, the server sends something back. Make sure the "postback url" isn't optional.

AndyEsser

Jan 26, 2011 at 12:23 PM

This is quite common with API's provided Paypal and such. The PostBackURL just has to be a script that is on your server. You can read the variables and they will involve things such as Authorisation Number, Confirmation Number, etc. All information you should really be logging.

This is a much simpler process to implement than using SOAP or some such technology as they are more involved.

You can access the variables like this in PHP:

$AuthNumber = $_POST['Auth']; - where 'Auth' is replaced by the field name specified by the API.

ArchG

Mar 3, 2011 at 9:52 AM

You can access the variables like this in PHP:

$AuthNumber = $_POST['Auth']; - where 'Auth' is replaced by the field name specified by the API.
[/quote]

string data = (string)Request["data"]; // where 'data' is replaced by the field name specified by the API

thought i'd give an asp.net example if you're familer with c#, might as well use it.

wildbunny

Mar 3, 2011 at 10:18 AM

Hi there,

As the others said, its simply a script (PHP or otherwise) which the payment provider's severs call out to...

Here is an example one that i've written before:


 // bitch slap header caching
 header("Expires: 0");
 header("Cache-Control: private"); 
 header("Pragma: cache");
 
 // this is the whitelist for offerpal 
 $offerpalWhitelist = array('74.205.58.114','99.132.162.242','99.132.162.245','99.132.162.243','99.132.162.244','173.203.141.129','209.61.169.131');
 
 // none but offerpal shall pass
 try
 {
 foreach ($offerpalWhitelist as $ipCandidate)
 {
 if ($_SERVER['REMOTE_ADDR'] == $ipCandidate)
 {
 // offerpal is calling us, verify MD5 hash
 
 // build string to hash
 $str = $_REQUEST["id"] . ":" . $_REQUEST["snuid"] . ":" . $_REQUEST["currency"] . ":" . OFFERPAL_SECRET;
 
 //echo md5($str);
 
 if ($_REQUEST["verifier"] == md5($str)) 
 {
 // all good, let them through
 
 // credit user with gold
 
 header("HTTP/1.0 200 OK");
 return;
 }
 else 
 {
 throw new Exception("bad md5 hash");
 }
 }
 }
 
 throw new Exception("bad ip address");
 }
 catch (Exception $e)
 {
 // log error in DB
 
 header("HTTP/1.0 403 Forbidden");
 }

This particular one was for OfferPal before they renamed to TapJoy

Hope it help...

Cheers, Paul.

Spac3Rat

Mar 18, 2011 at 2:06 PM

If you're a .Net programmer, the logic way would be for you to use a web form (.aspx) or a handler (.ashx).

You should expect the vendor API to send you some variables in that post. You can get them via Request.Form["name_of_variable"] and go from there.

The API should have some sort of documentation so you know what to expect.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.