Go语言在GAE上集成PayPal IPN：解决参数顺序问题的实践指南

package myapp

import (
    "bytes"
    "io"
    "log"
    "net/http"

    "google.golang.org/appengine"
    "google.golang.org/appengine/urlfetch"
)

// handleIPN 是处理PayPal IPN通知的HTTP处理器
func handleIPN(w http.ResponseWriter, r *http.Request) {
    // 确保请求方法是POST
    if r.Method != http.MethodPost {
        http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
        return
    }

    c := appengine.NewContext(r)
    client := urlfetch.Client(c)

    // 1. 构建回传给PayPal的请求体
    var validationBuf bytes.Buffer
    // 写入PayPal要求的验证参数前缀
    _, err := validationBuf.WriteString("cmd=_notify-validate&")
    if err != nil {
        log.Errorf(c, "Error writing cmd parameter: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 2. 将原始请求体内容复制到缓冲区
    // 注意：r.Body只能读取一次。如果后续需要解析r.Form，需要先将r.Body内容读出并保存。
    // 这里我们假设只用于回传验证，不再进行r.Form解析。
    _, err = io.Copy(&validationBuf, r.Body)
    if err != nil {
        log.Errorf(c, "Error copying request body: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 3. 定义PayPal的IPN验证URL
    // 生产环境请使用 https://www.paypal.com/cgi-bin/webscr
    // 沙箱环境请使用 https://www.sandbox.paypal.com/cgi-bin/webscr
    paypalVerifyURL := "https://www.sandbox.paypal.com/cgi-bin/webscr" // 或者生产环境URL

    // 4. 使用client.Post发送验证请求
    // Content-Type必须是 application/x-www-form-urlencoded
    resp, err := client.Post(paypalVerifyURL, "application/x-www-form-urlencoded", &validationBuf)
    if err != nil {
        log.Errorf(c, "Error sending IPN verification request to PayPal: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()

    // 5. 读取PayPal的验证响应
    paypalResponse, err := io.ReadAll(resp.Body)
    if err != nil {
        log.Errorf(c, "Error reading PayPal verification response: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 6. 处理PayPal的验证结果
    // "VERIFIED" 表示验证成功
    // "INVALID" 表示验证失败
    responseString := string(paypalResponse)
    if responseString == "VERIFIED" {
        log.Infof(c, "PayPal IPN VERIFIED. Processing transaction...")
        // 在这里处理业务逻辑，例如更新订单状态、发货等
        w.WriteHeader(http.StatusOK)
        w.Write([]byte("IPN Processed Successfully"))
    } else if responseString == "INVALID" {
        log.Warningf(c, "PayPal IPN INVALID. Possible fraud attempt or data tampering.")
        // 记录错误或进行其他安全处理
        http.Error(w, "IPN Verification Failed", http.StatusBadRequest)
    } else {
        log.Errorf(c, "Unexpected PayPal IPN verification response: %s", responseString)
        http.Error(w, "Unexpected IPN Response", http.StatusInternalServerError)
    }
}

func init() {
    http.HandleFunc("/paypal/ipn", handleIPN)
}