Securing M-Pesa Daraja API Callbacks: Preventing Man-in-the-Middle & Replay Attacks in PHP

The Vulnerability Landscape of Kenyan Payment Callbacks

Integrating Safaricom's M-Pesa Daraja API is the standard payment flow for e-commerce and fintech applications across Kenya. However, many production applications expose callback URLs (e.g., /api/v1/mpesa/callback) without strict request verification, creating dangerous attack surfaces where malicious actors can spoof payment confirmation payloads, fulfill unpaid orders, or execute replay attacks.

Core Security Protocols for M-Pesa Webhooks

1. Origin IP Whitelisting: Validate that incoming HTTP POST requests originate exclusively from Safaricom's authorized IP ranges (e.g., 196.201.214.*). Reject all requests from unexpected origins at the web server rewrite layer.
2. Strict Idempotency Keys & Unique Receipt Checking: Store the unique MpesaReceiptNumber in your database with a unique index. If a duplicate receipt number is posted, flag the transaction immediately and reject duplicate credit allocation.
3. CheckoutRequestID State Verification: Ensure the incoming callback matches an actively pending CheckoutRequestID stored in your Redis or database session with an unexpired TTL.
4. TLS 1.3 & HSTS Enforcement: Mandate modern cryptographic cipher suites and reject unencrypted HTTP communication.