Can I accept a mail request only on behalf of a domain?

Question

I apply the payment method in my application, and the bank’s website sends back a request with payment information, for example, status, payment identifier ...

But to be sure that the request is not from someone trying to do bad things, can I only accept the request from my banking system? I am looking for something to check the request for this action / controller only with mybank.com and skip the others.

Answer 1

You can restrict the route:

post 'yourpath', to: 'controller#action', constraints: { protocol: 'https://', host: 'yourbank' }

Answer 2

You can try to verify the request and reject the request that does not match:

if request.referer.starts_with?('https://your.bank/') # or request.env['HTTP_REFERER']
  # do stuff
else
  # render error
end

: ) . . b) , , .

: .