fix: use forwarded deviceIp for web-context MoonPay buy payment URLs#4205
Open
shadi-bp wants to merge 1 commit into
Open
fix: use forwarded deviceIp for web-context MoonPay buy payment URLs#4205shadi-bp wants to merge 1 commit into
shadi-bp wants to merge 1 commit into
Conversation
The allowedIpAddress param added in 4e698ca hashes the IP of the request to BWS. Web buy requests are proxied through the bitpay backend, so every web URL was IP-locked to that server instead of the customer, and MoonPay blocked the widget for all web buys. For web context, hash the customer IP forwarded by the proxy as deviceIp (web credentials are only held by the proxy, so the value is trusted for that context). If no deviceIp is forwarded, omit allowedIpAddress rather than sign an IP the customer can never match. Canonicalize the IP before hashing since HMAC has no tolerance for formatting differences. App-context behavior is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes BitPay web Buy via MoonPay dropping to 0 starting ~July 10 (internal ticket B1-3576). Sell and the app Buy flow were unaffected.
4e698ca5bimplemented MoonPay's on-ramp security upgrade, binding each signed widget URL to the customer's public IP via theallowedIpAddressparam (HMAC of the IP that requested the URL). Web buy requests don't come from the customer's device, though — they're proxied through the bitpay.com backend (frontend proxy wallet), so BWS hashed the proxy server's IP. Every web Buy URL was IP-locked to that server, and MoonPay's widget rejected the session for 100% of web users. The app flow was unaffected because the device calls BWS directly, and sell URL generation never includedallowedIpAddress.https://git.b-pay.net/bitpay/bitpay/-/merge_requests/11570
This PR has a companion bitpay MR that forwards the customer's real public IP (Cloudflare
cf-connecting-ip) asdeviceIpin the signed payment URL request. MoonPay's integration guide explicitly requires the true client IP behind the proxy/CDN and warns against using a server-side address.Changelog
moonpayGetSignedPaymentUrl: for web-context requests, hash thedeviceIpforwarded by the bitpay.com proxy instead of the BWS request IP. The forwarded value is trusted only for the web context, since web credentials are held exclusively by the proxy; app-context requests ignore a bodydeviceIpand behave exactly as before.deviceIp(proxy not yet updated), omitallowedIpAddressfrom the URL rather than sign an IP the customer can never match — the param is optional per MoonPay, so deploying this change alone restores web Buy immediately; the companion bitpay MR then re-enables the IP lock with the correct customer IP.::ffff:prefix) — HMAC is byte-exact and MoonPay hashes the plain IPv4 it observes.productionWebkeys), IPv4-mapped IPv6 canonicalization, omission ofallowedIpAddresswhen web sends nodeviceIp, and that non-web context ignores a bodydeviceIp.Testing Notes
Checklist