Security Concerns: Sending HTTP Requests from Magento

Question

I am currently developing an extension for Magento. One of the features of this extension is an Observer class that listens for the sales_order_credit_memo_save_after event. This event is fired once the store has issued a refund, thereby creating a credit memo.

I would now like to send the content of that credit memo to an external server using an HTTP POST request, sending the son_encoded string of the credit memo in the body; however, I am concerned with security issues. Since the URL will be hardcoded into the extension, anyone who downloads the extension will be able to see the URL and make random requests to it.

One can of course get the store name and store url and pass those along with the request so that the external server can check whether the request "came from" a Magento Extension (provided we have a list of store names and urls that are valid). However, a man in the middle can still intercept all of these data and do bad things.

I guess what I am looking for is some sort of HMAC mechanism where I can send a code from Magento along with the request and then decrypt that code in my external server application. That way, I would be able to check whether the request really came from our Magento Extension and not some random dude abusing our url. However, to do something like HMAC, I would need some sort of secret key, which I don't see how one would include/implement in this case.

Having said all that, I am open to other suggestions on how to alleviate some of the security concerns raised above.

Answer 1

I think that you have several options but IMO you have to:

Avoiding the "Man in the Middle"

Just using an HTTPs post instead HTTP.

Securing Data Contents/Requests

Here you have many options but basically you need to create a user/pass or token for every store owner (your service client) and implement some login system you can use Oauth, HTTP and others.

But if you are transferring very sensitive information you could also implement data hashing many payment gateways are using basic hashing technics to protect data, in that case you must give a hash code to every client (store owner) for use as salt.

Alternatively you may want to add some "server-level" brute force attack blocking but you wont need it at first.