Member Avatar for Goldfish691
Goldfish691 0 Newbie Poster

Hello everyone,

Sorry to post this in the general section, I wasn’t sure which one it falls under.

Ive been asked to develop a commercial site that has a shopping basket and the ability for the customers to purchase MP3 files. To start with I am going to integrate Paypals shopping basket into the site however, my question is how secure is this method? I know that the payment is secure through paypal but it seems that it only redirects the customer back to the website/download page after payment is made. Is there anything stopping the customer simply replacing the url with another file name and downloading more tracks without paying for them? If so, how would I go about stopping this happening?

I hope that all made sense to someone. Any input would be greatly appreciated.

Kind Regards

Craig

  • 1 Contributor
  • 0 Replies
  • 44 Views

Dani AI

Generated

, you are right to be wary: the PayPal auto-return/redirect is not proof of payment. Anyone with a guessed URL could hit a static download if you expose files directly. The pattern to follow is: never link to the file itself, and only grant access after a server-to-server verification of the payment (PayPal IPN or webhooks). After you verify a completed payment on your server, generate a one-time, short-lived token tied to the specific SKU(s), then stream the file through a protected endpoint. This prevents classic direct-object-reference issues where users swap filenames in the URL . See PayPal’s IPN docs for the server-side confirmation flow PayPal IPN.

Here is a minimal PHP sketch of the download gating (store MP3s outside web root, e.g., /secure/mp3s):

// After IPN confirms 'Completed':
$token = bin2hex(random_bytes(16));
$expires = time() + 3600; // 1 hour
$db->insert('downloads', ['token'=>$token,'file'=>'/secure/mp3s/track123.mp3','expires'=>$expires,'uses'=>0]);

// download.php?token=...
$row = $db->fetch('SELECT * FROM downloads WHERE token=?', [$_GET['token'] ?? '']);
if (!$row || $row['expires'] < time() || $row['uses'] >= 3) { http_response_code(403); exit; }
header('Content-Type: audio/mpeg');
header('Content-Disposition: attachment; filename="track.mp3"');
readfile($row['file']);
$db->execute('UPDATE downloads SET uses = uses + 1 WHERE token=?', [$_GET['token']]);

Practical tips:

  • Do not trust the return URL or query params; authorize only after IPN/webhook validation.
  • Bind tokens to order id, buyer email, and specific items; expire quickly; limit attempts/uses.
  • Log every download and rate-limit to curb sharing.
  • Keep files outside web root; no directory listing; always stream via your script over HTTPS.
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.