I'm working on integrating a 3rd party checkout, and discovered a security hole that i need help closing. Basically the checkout process is like this:
1.if certain conditions are met, when the customer clicks "checkout" they items in the cart get scraped and they are redirected to the 3rd party site.
2.they fill out their customer information and payment information
3.the payment is processed
4.after the payment is confirmed, they are redirected back to the merchant site
5.the order is processed programatically using the items currently in the cart and the customer receives their confirmation
6.Everybody is happy
The problem comes if someone edits the cart anytime during steps 2-4, Magento believes the new cart contents are what they paid for. This means someone could maliciously or accidentally add items of any value and get them without actually paying. Or delete items and not get them, even though they were paid for.
I'm not very familiar with how Magento saves quotes, but i'm hoping that there is a "cart ID" or something like that which represents the specific cart with its specific content, and that changes when something is added/deleted/edited in the cart. Then I can compare the number from when they left, to the number when they get back and make sure there's no fraud. Basically my worry is that even when they change items, the ID number i'm sending, getting back, and using to compare will remain unchanged.
So my questions are:
-Is there such a number?
-Where is it stored and how is it retrieved?
-Can it simply be loaded based on the number to repopulate the cart with the items in there at the time they were redirected to the 3rd party?
-If my plan won't work, why and is there a better way?
Thanks for the help guys. I wouldn't be able to get through all this without the answers here.