title: No IPN history and Paypal security
body: <p>Im sending the below form to PayPal</p>
  
  <pre><code>&lt;form name="myForm" method="POST" action="https://www.sandbox.paypal.com/cgi-bin/webscr" &gt;
  &lt;input type="hidden" name="cmd" value="_cart"/&gt;
  &lt;input type="hidden" name="business" value="myemail@myDomain.com"/&gt;
  &lt;input type="hidden" name="item_name_1" value="Product 1"/&gt;
  &lt;input type="hidden" name="amount_1" value="500.00"/&gt;
  &lt;input type="hidden" name="quantity_1" value="1"/&gt;
  &lt;input type="hidden" name="upload" value="1"/&gt;
  &lt;input type="hidden" name="currency_code" value="GBP"/&gt;
  &lt;input type="hidden" name="return" value="http://XX/paypal/completed.aspx"/&gt;
  &lt;input type="hidden" name="rm" value="2"/&gt;
  &lt;input type="hidden" name="cancel_return" value="http://XX/paypal/Cancel.aspx"/&gt;
  &lt;input type="hidden" name="shopping_url" value="http://XX/paypal/MyShop"/&gt;
  &lt;input type="hidden" name="notify_url" value="http://XX/paypal/MyShop/checkout.aspx"/&gt;
  &lt;input type="hidden" name="lc" value="GB"/&gt;
  &lt;input type="hidden" name="image_url" value="http://XX/paypal/shop.gif"/&gt;
  &lt;input type="hidden" name="no_note" value="1"/&gt;
  &lt;input type="hidden" name="invoice" value="ZZZ1234567890"/&gt;
  &lt;script type="text/javascript"&gt;document.myForm.submit();&lt;/script&gt;&lt;/form&gt;
  </code></pre>
  
  <p>I can successfully make a payment using the sandbox accounts (for buyer and seller). 
  I set up IPN to receive messages, enter a public URL which i can reach from outside my network.</p>
  
  <p>Everytime i make a payment i never see any history for the transaction? Do i need to add any additional configuration above or with my Paypal account? - the URL im looking at is:</p>
  
  <p><a href="https://www.sandbox.paypal.com/uk/cgi-bin/webscr?cmd=_display-ipns-history" rel="nofollow noreferrer">https://www.sandbox.paypal.com/uk/cgi-bin/webscr?cmd=_display-ipns-history</a></p>
  
  <p>I set up AutoReturn by enabling it as i need the transaction data to update my database with the response from paypal.</p>
  
  <p>I add the same URL as the notify_url to the Return URL, and enable Payment Data Transfer. I note the Identity Token but not needed to use this so far....</p>
  
  <p>Below is my C# code to process the response</p>
  
  <pre><code>try
  {
      string strRequest = string.Empty;
      string strLive = "https://www.sandbox.paypal.com/cgi-bin/webscr";
      HttpWebRequest req = (HttpWebRequest)WebRequest.Create(strLive);
      req.KeepAlive = false;
      req.ReadWriteTimeout = 600000;
      req.Timeout = 600000;
  
      //Set values for the request back
      req.Method = "POST";
      req.ContentType = "application/x-www-form-urlencoded";
      byte[] param = Request.BinaryRead(HttpContext.Current.Request.ContentLength);
      strRequest = Encoding.ASCII.GetString(param);
      strRequest += "&amp;cmd=_notify-validate";
      req.ContentLength = System.Text.Encoding.UTF8.GetByteCount(strRequest);
  
      //Send the request to PayPal and get the response
      Stream RequestStream = req.GetRequestStream();
      StreamWriter streamOut = new StreamWriter(RequestStream, System.Text.Encoding.UTF8);
      RequestStream.ReadTimeout = 600000;
      RequestStream.WriteTimeout = 600000;
      streamOut.Write(strRequest);
      streamOut.Close();
  }
  catch (Exception ex)
  {
  .....
  }
  </code></pre>
  
  <p>But i didnt need the Identity Token to verify anything? So im a little curious to know i've secured this correctly and that i dont need to add additional checks to ensure the page that processes the response cannot be easily manipulated?</p>
  
  <p>I know ive not posted the code that actually processes the database record but im checking to see if the form and the response from Paypal have any fields that i should base my checks on. </p>