amzn / amzn/amazon-pay-api-sdk-php
Use of stripcslashes breaks Amazon/Pay/API/Client::generateButtonSignature
- Dominant language
- PHP
- Stars
- 51
- Forks
- 33
- PR merge metrics
- No merged PRs in 30d
Description
I tried using this library today and was getting errors like below when clicking the checkout button in the browser:
`Error Code: InvalidSignatureError`
I was following the documentation [here](https://developer.amazon.com/docs/amazon-pay-checkout/add-the-amazon-pay-button.html#3-sign-the-payload). After struggling with this issue I tried removing the call to stripcslashes on the line below.
https://github.com/amzn/amazon-pay-api-sdk-php/blob/master/Amazon/Pay/API/Client.php#L404
Without stripcslashes it looked like `$hashedButtonRequest = self::AMAZON_SIGNATURE_ALGORITHM . "\n" . $this->hexAndHash($payload);`. With that change suddenly my checkouts were working. I also found that mangling the value passed to `payloadJSON` with stripcslashes got things working as an alternative to editing the library.
Anyway, the stripcslashes seems to be causing issues.
Contributor guide
Research direction
Start at Amazon/Pay/API/Client.php line 404 and compare the generated signature with the Amazon Pay checkout signing documentation. Reproduce the checkout using the reported payloadJSON behavior and verify that the resulting button request no longer produces InvalidSignatureError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, payments
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100