Is Moneris Direct Post Secure?

Question

I am looking at the Moneris Payment Processing and their Direct Post method. For the life of me, I can't figure out how the security on it works.

As best as I can tell it does this:

1. Web User comes to my site. They fill out their credit card information (https).
2. I show them a summary in a form. When they hit submit they go to Moneris (POST) - including my ID, credit card info, and a custom Transaction ID.
3. Moneris processes the transaction and sends them back to my site (as a POST)
4. If they arrive on failed.php or whatever URL you specify, the transaction failed. Else:
5. If they arrive on gotyourmoney.php then the transaction seemingly worked. Time to validate. (included in POST vars is a Unique ID for the transaction, date/time stamps, response_code (got money, didn't get money) and a few other miscellaneous items.
6. I redirect the user back to the moneris site with another POST. I include my ID again and the Unique ID returned in step 5 to verify the transaction.
7. User is redirected back to gotyourmoney_verified.php as a POST again with the unique ID, Transaction ID, and response_code.

What I can't figure out is this:

No where does there seem to be any information that I can validate that the web user can't just make up. Even though it is an https connection I'm trusting the user to pass all information. They could immediately go to the gotyourmoney.php page and never even go to the moneris payment gateway. They can just make up the ID's. When I send them back to moneris for the transaction verification, again they could just post a made-up response to my site.

What am I missing?

Answer 1

Indeed since all of those things go through the client, they can easily be spoofed. And the Moneris documentation doesn't tell you this. You need some sort of server-to-server step to be sure that everything is in order.

I would suggest doing a preauthorization using the hosted pay page and then doing a capture with the PHP API. Since you're doing the capture server-to-server, any attempt to spoof by the client will just result in a failed capture.