validation - When to validate paypal IPN when using a queue?

Question

When is it recommended to validate the paypal IPN?

Option 1 - Validate during the handler ipn post, then save and enqueue ipn if valid.

• Pros: An attacker can not fill your database by sending fake IPNs
• Cons:
  • Requires a longer response time for ipn post since you need to make a web request to validate, before being able to respond with a 200 OK in the ipn handler
  • An attacker can keep your web server busy trying to validate fake IPNs

Option 2 - Delay validation, save and enqueue ipn, respond with 200, then validate when processing the queue.

• Pros: Quick response to paypal IPN
• Cons: An attacker can fill your database by sending fake IPNs

Or do you do have something additional in place that avoids the problems of these two options?

Edit: I'm using the Paypal Adaptive Payments API, and am wondering what the recommended practice is while using that API.

Answer 1

PayPal 现在支持发送共享机密而不是回发验证。如果（a）您的按钮在发布时使用 HTTPS，并且（a）您notify_url使用 HTTPS，我更喜欢这个。

回发验证有许多问题，首先是要求以相同的顺序使用相同的 POST 变量。这是无法实现的，例如在您没有该级别控制的 servlet 中。然而事实上，这似乎并不重要，这让人对程序的其他安全方面产生怀疑。