amzn / amzn/amazon-pay-api-sdk-php

Use of stripcslashes breaks Amazon/Pay/API/Client::generateButtonSignature

Open
#13 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
51
Forks
33
PR merge metrics
No merged PRs in 30d

Description

I tried using this library today and was getting errors like below when clicking the checkout button in the browser:

`Error Code: InvalidSignatureError`

I was following the documentation [here](https://developer.amazon.com/docs/amazon-pay-checkout/add-the-amazon-pay-button.html#3-sign-the-payload). After struggling with this issue I tried removing the call to stripcslashes on the line below.

https://github.com/amzn/amazon-pay-api-sdk-php/blob/master/Amazon/Pay/API/Client.php#L404

Without stripcslashes it looked like `$hashedButtonRequest = self::AMAZON_SIGNATURE_ALGORITHM . "\n" . $this->hexAndHash($payload);`. With that change suddenly my checkouts were working. I also found that mangling the value passed to `payloadJSON` with stripcslashes got things working as an alternative to editing the library.

Anyway, the stripcslashes seems to be causing issues.

Contributor guide

Open the contributing guide

Research direction

Start at Amazon/Pay/API/Client.php line 404 and compare the generated signature with the Amazon Pay checkout signing documentation. Reproduce the checkout using the reported payloadJSON behavior and verify that the resulting button request no longer produces InvalidSignatureError.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, payments
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.