Backend Engineering and Application Security

Subham Padhi


## Why I am writing this?
I needed to design a system which included the payment as well. I searched for YouTube videos on how to integrate
payment gateways with the website and most of the video that comes at the top of search results have missed one or more
steps to securely integrate it. 
So In this article, I will explain the steps to securely integrate any payment gateway with your application.

## Understanding Transaction flow -
![Alt text](https://static-content.isubhampadhi.com/payment-gateway-integration-steps.jpg "Payment Flow")

#### Step 1 -
In the very first step user initiates payment by clicking the "Pay Now" button on the website's frontend.

#### Step 2 & 3 -
The request goes to the backend of the website and it commonly performs two things.
- Send a request to the payment gateway to create a new order.
- Create a new order on the backend database and store the ID of the order from the payment gateway as well. (Optional).
The second step will be helpful in case of retry of payment of the same order or refund of the order.

#### Step 4 & 5 -
Now send the required data from the payment gateway to the front of the website that will create a form for
the user to enter payment details.

#### Step 6 -
The user enters the payment details and submits the form. The payment may be successful or failure.

#### Step 7 (Important) -
This is the crucial step in the entire payment flow. After the payment gateway processes the payment request it will call an endpoint of your backend to send the update regarding the payment. The body of the request contains all the details about the payment. The endpoint should only process the requests from specific verified payment gateways.

#### Step 8 -
Now you have the payment details from the payment gateway. It's the developer's task to verify if the payment is valid based on the response from the payment gateway and update the status of the order in its backend system.

#### Step 9 -
Send a payment and order status to the user along with the receipt.

## The these steps will protect against the following attacks -
- If the developer checks the status of payment from the front end of the application, the user might manipulate the payment information on the front end.
- The user might pay a lesser amount than that of the actual amount and the backend may mark the payment as successful.
- If during payment web application crashes or the user disconnects due to some issue then also these steps will take care of the payment.
- In recent years many E-Commerce websites faced Social Engineering Attacks known as Refund fraud. Following the above steps, reduce the chances of such an attack as now you have a process defined for refund.



How to securely integrate any payment gateway with your web or mobile application to receive payments

Integrating Application With Payment Gateway


## What is Authentication and Authentication Vulnerability?
Authentication identifies the user and confirms that they are who they say they are. It's a very important as well as
critical functionality for any software. There may be different types of authentication methods -

- HTML Form-Based Authentication
- Windows Integrated Authentication using NTLM
- Multi-factor Authentication etc
........

Authentication Vulnerability arises from insecure implementation of the authentication mechanism of an application.

# Types of Authentication Vulnerabilities -

## Weak Password Requirements - 
This arises due to having no or minimal control over the quality of the user's password.

#### What to check for?
- very short or blank password
- common dictionary words or names
- use of default password
- The password is the same as the username
- missing or ineffective MFA

Possible Attacks - dictionary-based brute force attacks, MFA bypass

## Improper Restrictions of Authentication Attack -
This arises due to the absence of rate limiting or account lockout functionality after multiple incorrect login attempts.

#### What to check for?
- Multiple incorrect login attempts
- Unlimited requests to the following pages - 
    - login
    - MFA/OTP pages
    - Change Password page


Possible Attacks - brute force attack, Botnet attack, Denial of Service attack, account takeover etc.

## Insecure forget password functionality -
Design weaknesses in the forgotten password functionality usually make the weakest link that can be used to attack 
application's overall authentication logic.

#### What to check for?
- Too much trust in the user's input in the reset password page (like - token, username etc.)
- Missing check if the user has requested to reset the password
- Password reset token remains valid after a successful reset
- Improper check for validity of the token

Possible Attacks - brute force attack, account takeover etc.

## Verbose error messages -
The error message generated by the website gives more than the information required by the user.

#### What to check for?
- Incorrect username message for incorrect username
- Incorrect password message for incorrect password

Possible Attacks - information disclosure, brute force attack etc.

## Vulnerable transmission of credentials  -
The error message generated by the website gives more than the information required by the user.

#### What to check for?
- HTTPS to HTTP downgrade or no redirects from http to https version of the website
- TLS version downgrade

Possible Attacks - account takeover, cookie stealing etc.

Deep Dive into Authentication and type of Authentication Vulnerability

Backend Engineering and Application Security

Integrating Application With Payment Gateway

Exploring Authentication Vulnerability