Technical Report 004 · Denthinkers Foundation
Payments Confirmed on Cryptographic Proof
Why a donation is not complete because the browser says so.
Issue 01 · April 2026 · Filed under: Security · Payments
§1 Don't trust the client
A payment page that marks a donation successful because the browser reported success can be fooled by anyone with developer tools. At Denthinkers Foundation the donation module treats the client's claim as a hint, not a fact.
§2 Verify the signature
Razorpay signs each completed order. The server recomputes an HMAC-SHA256 over the order and payment IDs with the merchant secret and compares it with the signature returned. Only a match marks the payment confirmed.
§3 In production
The module spans fifteen API route handlers and twenty-three endpoints, with cookie-based JWT admin auth behind middleware-gated routes. It has processed more than ₹1.5 lakh in verified transactions on a platform serving over 2,500 monthly visits.