838066 - Make all notification postbacks POST form data

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P2)

Description

[Kumar McMillan [:kumar]]

Currently all postbacks receive JWT as raw post data. This is awkward to deal with in most web frameworks. Instead, let's POST regular form data like {jwt: theJWTData}. This will be easier to work.

Comment 1

[Andy McKay]

How do developers trust that the POST came from us? Signed JWT allows some level of trust.

Comment 2

[Kumar McMillan [:kumar]]

oh, the jwt would still be signed. I just meant that in the postback you currently have to do this:

def postback(request):
    jwt = request.read()
    # check signature

I'm suggesting the following:

def postback(request):
    jwt = request.POST['jwt']
    # check signature

I was trying to implement the raw post approach in node.js and found it pretty difficult to do without hacks. I looked at ruby and a couple other langs and it's really not straight forward to parse raw post body. Besides, what is the content type? application/jwt? We'd have to make one up or use octet stream. That's where it starts to get messy if we want to make this easy on developers.

Comment 3

[Andy McKay]

Ah ok that's fine.  In solitude I did add application/jwt fwiw :)

Comment 4

[Kumar McMillan [:kumar]]

pulls:
webpay: https://github.com/mozilla/webpay/pull/63
zamboni: https://github.com/mozilla/zamboni/pull/592

r?

Comment 5

[Kumar McMillan [:kumar]]

Fixed in webpay: https://github.com/mozilla/webpay/commit/ffaa2f259688b4a80d4a4528f29435ae3ac49d24
Fixed in zamboni: https://github.com/mozilla/zamboni/commit/2ccfc974d4cd88b26255590ceea4ac96b3387515

Comment 6

[Kumar McMillan [:kumar]]

The parameter I decided on is 'notice'. So the code above looks like:

def postback(request):
    notice = request.POST['notice']
    # check signature