738776 - Prevent repeat in-app payments with nonce

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: API, defect, P1)

Description

[Kumar McMillan [:kumar]]

Implement some sort of nonce to prevent in-app payments from being submitted twice (and also to prevent replay attacks).

Comment 1

[Kumar McMillan [:kumar]]

This bug was originally filed after security discussions. However, I chatted with rforbes about it and we decided it's a wontfix. Here are our reasons:

- The app hosting the iframe won't be able to sniff the POST requests made when the user clicks the confirm button so they can't do a replay attack (rforbes may try to see if he can get sniffing to work)
- We already have a csrf token on the confirmation form so we can trust the POST came from our confirmation form

In addition to a replay attack, the original topic also included stopping a user from accidentally buying something twice. We decided we can't really prevent that because any product can be legitimately bought twice. We may want to introduce some basic protection for this though like disabling the confirm button after the first click.