Hacker News Reader

Comment by si1entstill | Hacker News Reader

Looking at the docs (https://docs.bolt.com/v1/docs/step-2-load-bolt-checkout) it instructs the reader: "The onSuccess method will be called when Bolt successfully processes a transaction. This can be used as a way to create the order (...)". This opens up a massive security hole if the merchant is making decisions based on this method being called client-side, right? What prevents a malicious actor from calling that method directly and thus simulating an order as far as the merchant is concerned?

View on HN

Thanks for pointing this out. It was a shortcut for some very early beta testers. We've since removed it from the docs.

We have a server-based webhooks to create orders which is how we do secure order creation. Bolt provides a webhook (Bolt server -> merchant server) and REST APIs (merchant server -> Bolt server) to exchange data (including transaction details) through a secure channel.

Appreciate it again.

> This opens up a massive security hole

Have you considered that discussing API design decisions regarding security in a public forum is a bad decision of your own?

After literally 10 seconds on the site, I found this: https://bolt.com/security

"Security hole" may have been poor word choice on my part. "Potentially unsafe process recommendation" would probably be a more apt description.

My concern is not a security issue or vulnerability on their site or service. I am concerned that a processes they are recommending may not be safe, and if I am incorrect (I still feel that I may be missing something), I feel that a response may be insightful to others.

Nah, his post is what Hacker News is for; if the company and their CEO is announcing coming out of stealth mode and answering responses, it's worth that guy vocalizing that potential vulnerability.

Your post tried to chastise him for calling out a vulnerability, and then tried to shame him for not quietly emailing their security team. Chances are if someone were a bad actor they would have: A) seen that themselves outside of his message, or B) Found out through sheer luck and brute force

If anything, the poster mentioning it invites the team to fix it before someone exploits it. It's worse to blunder on a hole someone told you was 1.5km down the road, so hopefully they either address it or fix it

I imagine there is an HMAC or similar that can be verified?

Reply on news.ycombinator.com