Databases
StackOverflow2013
Postsdbo
POHow to pass paypal API credentials SECURELY in with php (and why is this not considered secure)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to pass paypal API credentials SECURELY in with php (and why is this not considered secure)
    primarykey
    data
    text
    <p>So obviously the paypal API code is not very easy to read or understand, neither is the documentation which is provided. <a href="http://digitalgoods.co/" rel="nofollow">This guy agrees with me.</a> </p> <blockquote> <p>If you’ve spent more than a few minutes in the PayPal documentation, you will know it’s easier to manually decrypt a 1024 bit RSA private key than to understand the PayPal Digital Goods with Express Checkout API.</p> </blockquote> <p>So I finally figured out how to get PHP to communicate with the paypal API through this sample code:</p> <p><a href="https://ppmts.custhelp.com/app/answers/detail/a_id/945/kw/php" rel="nofollow">https://ppmts.custhelp.com/app/answers/detail/a_id/945/kw/php</a></p> <p>However PayPal completely distances themselves from the samples they provide, they must have an interest in developers spending hours and hours to figure out the system, rather than to just give them code that's easy to implement and start getting paid. I wonder how they got so successful... </p> <p><em>As a matter of fact the sample code even says that it's not secure and should not be used for production:</em></p> <pre><code>// Set API creds and version greater than 65.1, also set endpoint and redirect url //**************************************************// // This is where you would set your API Credentials // // Please note this is not considered "SECURE" this // // is an example only. It is NOT Recommended to use // // this method in production........................// //**************************************************// $APIUSERNAME = "xxxx"; $APIPASSWORD = "xxxx"; $APISIGNATURE = "xxxx"; $ENDPOINT = "https://api-3t.sandbox.paypal.com/nvp"; </code></pre> <p>Essentially what happens is these variables are used to create a string which contains all the information about the purchase as well as the API credentials. The string is made up of each index and value pair and connected with ampersands <code>$req_str = "USER=xxxx&amp;PWD=xxxx";</code> and so on. This string gets passed to a function <code>PPHttpPost($ENDPOINT, $req_str);</code>. This function uses <code>curl_init();</code> and related functions to somehow communicates with the paypal server and returns a unique key to identify the transaction and it's values. </p> <p>I am not exactly sure how this function works but it is listed on the link I provided above under "functions.php".</p> <p>Two questions:</p> <p><strong>1.) Why is this not considered secure?</strong></p> <p><strong>2.) If it's not secure to tell the application about your API credentials by writing them into variables, <em>then what is</em> ?</strong></p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USolli
    1. USolli
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow to pass paypal API credentials SECURELY in with php (and why is this not considered secure)
      1. USCodeguy007
      1. VTFavorite
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload