Check the AdsLab sender IP, and what Cloudflare does to it
Their postbacks come from one address. Enforcing it is free — unless you are behind Cloudflare, where REMOTE_ADDR is Cloudflare and the check rejects everything.
Tagged “postback”
5 entries
Credit an AdsLab postback once, and handle reversals
Dedupe on the transaction id, answer 200 to everything, and treat a reversal as the full chain — user credit and referral commission both.
Verify an AdsLab postback signature
It is sha256 of the transaction id, a hyphen and your Security Hash — not the Publisher API key their integration page names.
Handle an offerwall postback without paying twice
Signature check, unique constraint, credit inside a transaction. Networks retry postbacks, so the same completion will arrive more than once.
Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.