Skip to content

[SECURITY][PAYMENT CALLBACKS] Require a configured canonical application origin #185

Description

@Obiajulu-gif

Summary

Payment callback URLs fall back to the incoming request origin. In deployments where the public URL is missing or proxy host validation is weak, a crafted host can be reflected into the provider redirect.

Repository evidence

  • app/api/payments/initialize/route.ts:11-13 derives the callback from new URL(request.url).origin.
  • app/api/driver/payments/initialize/route.ts:13-15 and app/api/payments/down-payment/route.ts:123 repeat the fallback.

Scope

  • Require a validated HTTPS application origin outside local development.
  • Centralize callback construction and allowlist exact paths.

Acceptance criteria

  • Production startup fails when the canonical origin is absent or unsafe.
  • Request host headers cannot influence Paystack callback URLs.

Tests

  • Exercise spoofed Host/Forwarded headers, HTTP origins, trailing paths, and valid local-development overrides.

Non-goals

  • Changing the post-payment dashboard destinations.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third Campaign

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions