We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point.
Am worried the about the data which we might expose in the return call and looking for some best practices implementation.
Am planning to do this as per the hosted payment page expectation on flow
In our MVC application we have a sales page where user add the amount, comments and other required fields and submit
after validating setting the required fields along with the Callback URL redirecting the user to Hosted payment page from different Vendor
Once the transaction is completed the Hosted payment page Call back my Call back URL which is one of the End points in MVC
In the call back URL(Anonymous access) basically am decoding the result they shared in Query string and calling their API to decode and showing the end results to user in the same Sales page(Secured)(where 302 , 200 redirecting from callback url(Anonymous) to sales page(Secured) happens)
My sales page is Secured but my call back URL is exposed So my questions is am i exposing the sales page to Hosted payment page or any security concern by doing this.
I checked this in fiddler if you are not a logged in user you will be redirected to the login page. so what are the security risk am carrying with my current implementation of exposing my callback URL and the call back URL internally redirect to a different action.
What are the best praises to handle this. Please share your ideas