GX-Task #70799
Von Rico Schreiber vor 6 Monaten aktualisiert
_Description_ :
Using the EU's VAT ID Check API, the VAT identification number can be checked.
The EU blocks the IP address of the shop if the API is misused. It is possible to misuse the API via the shop.
_How to reproduce_
If the live check of the VAT ID is activated in the shop, a request is always sent to the EU during creation of a customer account, even if only a "1" is entered as the VAT ID.
1. Register and enter something to the Vat ID field
2. Repeat 10.000 times in a short period of time. (i.e. with a bot that spams registrations)
_What should we do now?_
1. Refactor VAT ID check to avoid redundancy. There are currently two different mechanisms in use for checking the VAT ID: One legacy class used for registration, one service used for updating existing customers VAT ID from the admin interface.
2. The shop should already check the format of the VAT ID.(Two letters followd by a bunch of numbers) If this is not valid, there shouldn't be a request to the API. Show an error message.
3. Cache the result of the API for one hour. So if the same number is requested several times in a row only one request per hour to the API is made.
4. implement a limit (max 3 vatid-live-check-calls per IPadress per minute) to avoid too many requests to the VAT ID Check API.
_How can I test this?_
Invalid format:
1. Install shop
2. Try registering a new account using a VAT-ID with an invalid format (like "123").
Expected result:
The registration fails and informs the user about the VAT-ID being invalid.
The database table "vatid_live_check_triggered" does not contain a recent entry for your IP.
The database table "vatid_live_check_cache" does not contain an entry for the entered VAT-ID.
Valid format, invalid VAT-ID:
1. Install shop
2. Try registering a new account using a VAT-ID with a valid format, but an invalid value (like DE000000000)
Expected result:
The registration fails and informs the user about the VAT-ID being invalid.
The database table "vatid_live_check_triggered" contains a recent entry for your IP.
The database table "vatid_live_check_cache" contains a recent entry for the entered VAT-ID.
Valid VAT-ID:
1. Install shop
2. Try registering a new account using a (known to be) valid VAT-ID.
Expected result:
The registration is successful.
The database table "vatid_live_check_triggered" contains a recent entry for your IP.
The database table "vatid_live_check_cache" contains a recent entry for the entered VAT-ID.
Limited access to the VAT-ID-Live-Check:
1. Install shop
2. Open the registration form for new customers and enter valid values into all required fields.
3. Within one minute try registering 3 times with VAT-IDs that are valid in format, but invalid in value by using the corresponding field. Examples for VAT-IDs fitting these criteria: DE000000000, DE000000001, DE000000002
4. For a fourth attempt, try to register with a valid VAT-ID.
Expected result:
The registration fails informing the user about an invalid VAT-ID.
The database table "vatid_live_check_triggered" contains 3 recent entries for your IP.
The database table "vatid_live_check_cache" contains a recent entry for all the entered VAT-IDs except for the fourth one.