skills.rest
doccker
docckerCOMMUNITY
Explore all skills by this author →
GitHub

cc-payment-callback-safety

Validates payment callback and webhook handlers against forgery, replay, and amount tampering.

1.0k|109|Updated Jan 4, 2026
Search Tags:#Idempotency#signature verification#webhook security#wechat pay#payment validation#replay attack#payment callback
One-click install
npx skills add https://github.com/doccker/cc-use-exp --skill cc-payment-callback-safety
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cc-payment-callback-safety
Source: https://github.com/doccker/cc-use-exp/tree/main/.codex/skills/cc-payment-callback-safety
Command: npx skills add https://github.com/doccker/cc-use-exp --skill cc-payment-callback-safety

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Payment callbacks and webhooks (WeChat Pay, Alipay, Stripe, PayPal) are exposed to the public internet, making them targets for forged notifications, replayed messages, and amount tampering. This Skill provides a security checklist and code patterns to audit callback handlers before these vulnerabilities reach production.

Core Features & Use Cases

  • Signature Verification Enforcement: Ensures callbacks verify the platform's public key signature before decryption or processing, with support for certificate rotation by serial number.
  • Replay Attack Prevention: Covers three-layer defense using timestamp windows, transaction_id idempotency, and order state machine checks.
  • Business Consistency Validation: Enforces strict matching of callback amounts, out_trade_no, appid, and mchid against local order records, and unifies validation logic between callback and reconciliation paths.
  • Use Case: Before shipping a WeChat Pay V3 integration, run this checklist against your callback controller to confirm signature verification happens before decryption, duplicate notifications return success idempotently, and no placeholder TODO implementations return fake data.

Quick Start

Review my payment callback handler for WeChat Pay and check it against the signature verification, replay prevention, and amount consistency rules.

Frequently Asked Questions about cc-payment-callback-safety

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a WeChat Pay callback signature?▼

Verify the callback by concatenating timestamp, nonce, and request body, then checking the Wechatpay-Signature header against the WeChat Pay platform public key. Use the Wechatpay-Serial header to select the correct platform certificate, and only decrypt the body after verification passes.

How to prevent replay attacks on payment webhooks?▼

Use three layers: reject callbacks with timestamps outside a five-minute window, deduplicate by transaction_id so already-processed payments return success without reprocessing, and check the order state machine so paid orders are skipped idempotently.

Should I trust the amount in a payment callback?▼

No, always compare the callback amount against the local order's expected amount in the same unit, such as fen for WeChat Pay. On mismatch, refuse to credit the payment, mark the record as mismatched, and log the discrepancy for reconciliation.

Does this apply to Stripe and PayPal webhooks too?▼

Yes, the same principles apply to Stripe Webhooks, PayPal IPN, Alipay, and other third-party payment notifications. Signature verification, replay defense, and amount consistency checks are platform-independent requirements.

Why is it dangerous for payment reconciliation to skip validation?▼

Reconciliation and callbacks both confirm payment success, so skipping amount, mchid, or appid checks in the reconciliation path leaves a security gap. Extract one shared validation function and reuse it in both paths, trusting only the platform's order query API response.

Related Skills

Explore More Software Engineering Skills→
NerveNetworkNerveNetwork
1

paybox-payment

Integrate PayBox to collect multi-chain payments as USDT on a Nerve address.

Official
Advanced
pukpuklouispukpuklouis

gomypay

Integrate GOMYPAY credit card payments with MD5 verification and refunds.

Community
Advanced
FlexasaurusrexFlexasaurusrex
16

vaultkeeper

Track credential rotation and scan public repositories for exposed secrets.

Community
Advanced
vorynkavitaliyvorynkavitaliy

stripe-integration

Integrate Stripe Checkout Sessions, Payment Intents, and webhooks into applications.

Community
Advanced