# Online Payment URL Security

**URL:** <https://www.dolibarr.org/forum/t/online-payment-url-security/23005>\
**Category:** Financial modules\
**Created:** [November 6, 2022, 9:28am UTC](https://www.dolibarr.org/forum/t/online-payment-url-security/23005 "2022-11-06T09:28:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jewelion](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/a8b319/32.png) [@Jewelion](https://www.dolibarr.org/forum/u/Jewelion)\
**Post date:** [November 6, 2022, 9:28am UTC](https://www.dolibarr.org/forum/t/online-payment-url-security/23005/1 "2022-11-06T09:28:44Z")

</div>

When you send a customer a URL using **ONLINE\_PAYMENT\_URL** it produces a URL like:  
**[https://xxxxxxxxx/public/payment/newpayment.php?source=invoice&ref=invoice\_ref](https://xxxxxxxxx/public/payment/newpayment.php?source=invoice&ref=invoice_ref)**  
The invoice ref is in the form INyymm-nnnn

By altering the numbers, especially the nnnn part of the invoice ref a recipient is able to see not only other invoice amounts but also the other third party names.

That, I believe, is classified as a data leak. I would have hoped that an unguessable UUID style ref would be passed. Is there some way of making this more secure or do we have not to use this feature for fear of breaching data protection?

---

<div class="post-metadata">

**Author:** ![priojk](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/priojk/32/6121_2.png) [@priojk](https://www.dolibarr.org/forum/u/priojk)\
**Post date:** [November 6, 2022, 9:45am UTC](https://www.dolibarr.org/forum/t/online-payment-url-security/23005/2 "2022-11-06T09:45:05Z")

</div>

You probably forgot to activate the use of a security key in your payment module setup. This prevents the effect you mentioned.