Shopware 6 · CoriunderHostedGateway

A Shopware 6 payment plugin that has been through a security audit.

Constant-time signature checks, per-transaction locking, idempotent webhooks and HTTPS-enforced callbacks — documented, not implied. Two packages cover Shopware 6.5/6.6 and 6.7.

6.5 · 6.6 · 6.7
Shopware
SHA-256
Signed webhooks
Idempotent
Replay-safe
What you get

Built for Shopware 6, not ported to it

An asynchronous redirect payment handler built on Shopware’s own DAL and lock primitives.

Hosted payment page

The shopper pays on Coriunder’s page and returns to your store. The plugin produces no HTML output — only redirects and JSON responses.

Constant-time signatures

Webhooks are verified with a SHA-256 signature compared using hash_equals(), so a forged callback is rejected.

Replay and duplicate safe

An idempotency guard skips transactions already in a terminal state, and a per-transaction lock returns HTTP 429 to concurrent duplicates.

Clear status mapping

Reply 000 sets the transaction to paid, 553 leaves it awaiting the follow-up webhook, and anything else marks it failed.

DAL only

All persistence goes through Shopware’s Data Abstraction Layer with parameterised queries — no hand-built SQL.

Two packages, one plugin

Package A targets Shopware 6.5/6.6 on PHP 8.1+ with the legacy asynchronous payment API; Package B targets 6.7 on PHP 8.2+.

How it works

From cart to confirmed order

An asynchronous payment flow, settled by a verified webhook.

Shopper picks Coriunder

The payment method appears at checkout once the plugin is installed, activated and assigned to your sales channel.

They pay on the hosted page

Shopware redirects to the Coriunder payment page with an HTTPS-enforced return and notification URL.

They return to your store

The return URL is generated by Shopware core rather than supplied by the request, closing off open-redirect abuse.

The webhook settles it

Coriunder POSTs to /coriunder/webhook. The signature is verified, the transaction is locked, and the state is set.

Built for trust

The audit summary, in the open

Each concern below is paired with the mitigation actually implemented in the plugin, from forged webhooks through to log injection. It is the same table published in the technical documentation.

Debug logging writes to var/log/ and contains no customer PII and no personal hash. Disable it in production.

See the technical documentation
  • Forged webhooks. SHA-256 signature verified with constant-time hash_equals().
  • Duplicate delivery. Per-transaction Symfony lock with a 10-second TTL; concurrent requests receive HTTP 429.
  • Replay attempts. Transactions already in a terminal state are skipped by the idempotency guard.
  • Log injection. Newlines are stripped from trans_id before it is logged.
  • Input tampering. Every webhook field is regex-validated, and reply_desc is sanitised before use.
  • Open redirect. Return URLs come from Shopware core, never from the incoming request.
Requirements

Check your store in ten seconds

Current release: 1.1.2, published as two packages.

RequirementSupported
Package AShopware 6.5.x / 6.6.x · PHP 8.1+ · legacy asynchronous payment API
Package BShopware 6.7.x · PHP 8.2+
PHP extensionshash (bundled), openssl recommended
FlowRedirect (asynchronous) — the shopper pays on the Coriunder page and returns to the store
WebhookPOST https://your-store.com/coriunder/webhook, built automatically from the store domain
LicenseProprietary
Installation

Live in four steps

Upload it in the admin, or install it from the console.

Pick your package

Choose the 6.5–6.6 archive or the 6.7 archive to match your Shopware version.

Upload

Go to Extensions → My Extensions → Upload Extension, then Install and Activate.

Or use the console

Copy the folder to custom/plugins/ and run plugin:refresh, then plugin:install --activate CoriunderHostedGateway.

Configure

Enter the Merchant ID, Payment Page URL and Personal Hash, choose the payment page language and transaction type, and enable the gateway.

Questions

Frequently asked

Which package do I need?

Package A for Shopware 6.5.x and 6.6.x on PHP 8.1+, Package B for Shopware 6.7.x on PHP 8.2+.

What happens if a webhook arrives twice?

The idempotency guard skips transactions already in a terminal state, and a per-transaction lock returns HTTP 429 to a concurrent duplicate.

What does reply code 553 mean?

3-D Secure is still in progress. The transaction state is left unchanged until the follow-up webhook arrives.

Which languages can the payment page use?

en-GB, en-US, he-IL, ru-RU and de-DE.

What happens when I uninstall it?

The payment method is deactivated but not deleted, preserving the payment records on existing orders. Remove the files afterwards with bin/console plugin:delete CoriunderHostedGateway.

Is customer data written to the logs?

No. Debug logging excludes customer PII and never records the personal hash. It should still be disabled in production.

Ready to accept payments?

Download the package that matches your Shopware version and connect your store to Coriunder.