This skill provides specialized guidance for handling third-party payment notifications such as WeChat Pay, Alipay, and Stripe. It enforces rigorous security standards including signature verification using platform public keys, three-layer anti-replay protection (timestamp window, transaction ID idempotency, and state machine checks), and strict amount consistency validation. By integrating these patterns, developers can ensure their payment systems are resilient against common vulnerabilities like callback spoofing, double-entry errors, and malicious amount modification during the notification phase.
주요 기능
01Platform-specific signature verification using public keys
02Strict amount and Merchant ID consistency validation
03Detection and prevention of placeholder or mock implementations
04772 GitHub stars
05Three-layer anti-replay protection (Timestamp, ID Idempotency, State Machine)
06Unified validation logic for both callbacks and manual reconciliation
사용 사례
01Auditing existing webhook handlers for security vulnerabilities like replay attacks
02Securing WeChat Pay and Alipay callback endpoints in production environments
03Standardizing payment reconciliation logic across multiple payment providers