Server-Side Payment Verification in Nepal: How to Stop Spoofed eSewa and Khalti Transactions

Many beginner tutorials in Nepal end with this dangerous pattern: ```javascript // DANGEROUS CODE - DO NOT USE router.get("/payment/success", async (req, res) => { // Attacker simply visits: /payment/success?order_id=105 await Order.update({ id: req.query.order_id }, { status: "PAID" }); res.send("Thank you! Your order has been delivered."); }); ``` Any visitor can open DevTools, copy the success URL, and trigger order fulfillment without spending a single Rupee. ### The 4 Pillars of Secure Payment Verification: 1. **Never trust query parameters:** Never treat `?status=COMPLETE` in the browser URL as proof. 2. **Server-to-Server Lookup:** Your server must initiate an outbound HTTPS request directly to eSewa's status API or Khalti's `/lookup/` endpoint. 3. **Double-Verify the Amount:** Verify that `response.total_amount === order.total_amount`. 4. **Idempotent Transitions:** Ensure orders in state `PAID` cannot be re-triggered by repeated network callbacks.