Is VPSSignature utilised?

[losttheplot]

Hi, given that this class is not yet complete, does it carry out the md5 hash check using VPSSignature, please?

[judgej]

Yes, it's in Academe\SagePay\Server::notification(), see here https://github.com/academe/SagePay/blob/master/src/Academe/SagePay/Server.php#L213

It checks there whether the notification has been tampered with, before accepting the results it provides. It means that SagePay can send the results of the transaction to your site over a HTTP channel (you don't need a HTTPS certificate on your server, though obviously it is desirable to have one for other user interaction with your site).

[judgej]

The example of a callback controller that calls notification() is on the main readme https://github.com/academe/SagePay

[losttheplot]

Thanks, and I'm sorry to trouble you - I should have searched harder before posting.

[judgej]

Not a problem at all :-) Glad to see the package being useful, and more questions can only lead to improvements to the code or the documentation.