Redirect Security
Keep checkout navigation separate from payment authorization.
Allow only exact domains you control and use HTTPS in production. Do not use wildcard domains, accept user-supplied return URLs, or place secrets in query parameters.
Success and cancel URLs execute in an untrusted browser. A customer can open, replay, or modify navigation. Use invoiceId only as a lookup key; require a verified invoice.paid webhook and/or authenticated invoice status before changing an order.