skills.rest
doccker
docckerCOMMUNITY
Explore all skills by this author →
GitHub

payment-callback-safety

Validates payment callback handlers against signature forgery, replay attacks, and amount tampering.

1.0k|109|Updated Jan 4, 2026
Search Tags:#Idempotency#signature verification#webhook security#wechat pay#payment reconciliation#replay attack#payment callback
One-click install
npx skills add https://github.com/doccker/cc-use-exp --skill payment-callback-safety
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: payment-callback-safety
Source: https://github.com/doccker/cc-use-exp/tree/main/.cursor/skills/payment-callback-safety
Command: npx skills add https://github.com/doccker/cc-use-exp --skill payment-callback-safety

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Payment callbacks and webhook endpoints are exposed to the public internet, making them targets for forged notifications, replayed messages, and amount manipulation. This Skill provides a defensive checklist and code patterns to prevent fake payment confirmations, duplicate processing, and inconsistent reconciliation logic.

Core Features & Use Cases

  • Signature Verification Enforcement: Ensures callbacks are verified with the platform public key (e.g., WeChat Pay platform certificate) before decryption or processing, with certificate rotation support via serial number matching.
  • Replay & Idempotency Protection: Applies timestamp window checks, transaction_id deduplication, and order state machine guards so duplicate notifications are safely acknowledged without reprocessing.
  • Amount & Identity Consistency Checks: Requires strict comparison of callback amounts, out_trade_no, appid, and mchid against local order and tenant configuration, shared between callback and reconciliation paths.
  • Use Case: When implementing a WeChat Pay V3 or Alipay callback endpoint in a Java Spring service, use this Skill to audit the handler for missing signature verification, missing idempotency, or placeholder TODO implementations that return fake data.

Quick Start

Ask the AI to review your payment callback or webhook handler code against the payment-callback-safety checklist before deploying it.

Frequently Asked Questions about payment-callback-safety

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a WeChat Pay callback signature in Java?▼

Build the message as timestamp + newline + nonce + newline + body + newline, then verify it with the WeChat Pay platform public key matching the Wechatpay-Serial header. Never use the merchant private key, and reject the request before decrypting if verification fails.

How to prevent replay attacks on payment webhook endpoints?▼

Apply three layers: reject callbacks outside a 5-minute timestamp window, deduplicate by transaction_id in the payment record table, and check the order state machine so already-paid orders are skipped. Return success for duplicates so the platform stops retrying.

Should I trust the amount in a payment callback notification?▼

No. Always compare the callback amount against the local order's expected amount in the same unit (e.g., fen) before crediting. On mismatch, refuse to settle, mark the record as mismatched, and log the discrepancy for reconciliation.

Does this guidance apply to Stripe webhooks and PayPal IPN?▼

Yes. The same principles apply: verify platform signatures, enforce timestamp windows, deduplicate by event or transaction ID, and validate amounts against local orders. The Skill explicitly covers Stripe Webhooks, PayPal IPN, Alipay, and WeChat Pay API v3.

Why is it dangerous to leave TODO placeholders in payment query code?▼

Placeholder implementations that return fake data like a hardcoded NOTPAY status can silently corrupt order states in production. Placeholders must throw an exception such as UnsupportedOperationException so unimplemented payment logic fails loudly before release.

Related Skills

Explore More Software Engineering Skills→
nekorush14nekorush14
4

rails-state-machines

Automate Rails model state machines with explicit transitions and guards.

Community
Advanced
valentinmatheyvalentinmathey

bb-backoffice-payments

Apply FIFO accounting rules to reconcile order-payment ledgers via Prisma transactions.

Community
Advanced
openaiopenai
5.3k

twilio-debugging-observability

Diagnose Twilio integration errors and configure production monitoring with alerts, event streams, and status callbacks.

Official
Advanced
aberrantCodeaberrantCode
1

web-payments

Integrate Stripe checkout, subscriptions, and billing into web applications.

Community
Advanced