Problem with Notification_Token

Hi forum,

I'm developing a e-commerce solution ( Link (http) and as part of this I'm implementing integration to delcampe for a customer (delcampe user: jf-stamps).

I'm facing a challenge with the api Notification_Token.

I'm updating an notification setting by calling:
POST Link (http) HTTP/1.1
notificationType=Curl_Seller_Item_Close_Unsold&destination=mydomain.com/Api?token=myCallbackToken

When I'm calling to get the setting back, the destination still holds the token part: mydomain.com/Api?token=myCallbackToken

And when I'm receiving notifications from delcamp the Notification_Token is empty:
<?xml version="1.0" encoding="UTF-8"?> <Delcampe_Notification>
<Notification_Token></Notification_Token>
<Notification_Datetime>2018-06-28T20:44:14+00:00</Notification_Datetime>
<Notification_Type>Seller_Item_Close_Unsold</Notification_Type>
<Notification_Data>
<id_item>297666551</id_item>
<personal_reference>158537</personal_reference>
</Notification_Data>
</Delcampe_Notification>

Instead the token is included in the querystring of the callback:
user: anonymous
userHostAddress: 82.146.118.178
userHostName: 82.146.118.178
url: /Api?token=myCallbackToken
method: POST

Wasn't the token supposed to be cut off the destination url and included in the XML postback?
Can the reason be that "?" and "=" are encode in the request to Link (http) :
notificationType=Curl_Seller_Item_Close_Unsold&destination=http%3A%2F%2Fjf-stamps.dk%2FApi%3Ftoken%3DmyCallbackToken

and that you're not resolving it correctly on your end? (hint: searching for ? in the string and not decoding it from %3F)

Or am I doing anything wrong?

Best Regards,
Henrik Stenbaek

Hi Benjamin

Please delete your post ASAP

/Henrik

Dear Benjamin,

Thank your for your response that ended up giving me more serious problems - and thank you for deleting your post again.

After you decided to post a link to our callback endpoint (and the token that we wanted to use for the callbacks) our website was vulnerable to a malicious user, who would be able to use the information you decided to make public in this forum, to serious harm out website (set products as sold, creating cascade of orders etc.)

I have now spend the last hours changing the coding behind our webside so that the endpoint has now changed.

From now on please don't post information about the secret parts of our setup.

I have changed the callback endpoint - please don't tell the address in this forum.
I have changed the callback token - please don't tell what it is in this forum

After I have changed the endpoint address I needed to also update the notification/setting. I did that by:

- firstly: disable the old one by using the DELETE notification/{setting_id}
- then: POST notification/settings to add our new URL (Notice: never post any information about what the endpoint address is in this forum, neither any information about the token)

after posting updates to notification/settings I bumped into this other problem: for some of the notificationTypes I have reached the maximum allowed numers of settings (hint. 5) and therefore I do not have any setting configured for this notificationTypes, this situation includes the types:

Curl_Seller_Item_Close_Unsold
Curl_Seller_Item_Add

Therefore I'll kindly ask you to delete all the non active notifications endpoint for the account in question, so that I can create the new one.

Also: please avoid to tell anything about the endpoint address and the secret token, as I then will need to change everyting again.

Regards
Henrik Stenbaek

Die Informationen sind nicht mehr verfügbar, da das Konto dieses Benutzers gelöscht wird (DSGVO-Grundverordnung).

Die Informationen sind nicht mehr verfügbar, da das Konto dieses Benutzers gelöscht wird (DSGVO-Grundverordnung).

Die Informationen sind nicht mehr verfügbar, da das Konto dieses Benutzers gelöscht wird (DSGVO-Grundverordnung).