Ankit Sinha · Backend EngineerTechnical Report 004Issue No. 01 · 27 SEP 2026

Ankit Sinha



Payments Confirmed on Cryptographic Proof

Why a donation is not complete because the browser says so.

Issue 01 · April 2026 · Filed under: Security · Payments

BROWSER01RAZORPAY02SIGNATURE03HMAC04CONFIRM05

§1 Don't trust the client

A payment page that marks a donation successful because the browser reported success can be fooled by anyone with developer tools. At Denthinkers Foundation the donation module treats the client's claim as a hint, not a fact.

§2 Verify the signature

Razorpay signs each completed order. The server recomputes an HMAC-SHA256 over the order and payment IDs with the merchant secret and compares it with the signature returned. Only a match marks the payment confirmed.

§3 In production

The module spans fifteen API route handlers and twenty-three endpoints, with cookie-based JWT admin auth behind middleware-gated routes. It has processed more than ₹1.5 lakh in verified transactions on a platform serving over 2,500 monthly visits.