Question

I would like to hear you opinion on how to make secure buttons with django-paypal. I do have a subscription based website an, if possible, I do not want to use the encrypted buttons that django-paypal supports.

Furthermore I don’t think that it is possible to use the protected payment buttons that paypal provides (the ones where you do not send the ammount, period,… via your button but have this information saved on the paypal side.)

So the only other alternative I can think of, is to use the IPN information that paypal sends and compare it to my payment plans (which actually looks quite secure to me). Is this right, or is there another alternative?

Answer 1

Your idea is fine and will work. You can use some sanity checks on the IPN when it comes in.

def handle_ipn(sender, **kwargs):
    ipn_obj = sender
    gross = str(ipn_obj.mc_gross)
    currency = str(ipn_obj.mc_currency)

    if ipn_obj.item_name == 'myproduct' and
       ipn_obj.custom == 'mycustom' and
       currency == 'USD' and gross == '99.00':

       # Do stuff here...

This will work well enough in simple cases, but where you have multiple prices, products, currencies or vouchers it gets more fiddly.