The CoriunderHostedGateway plugin, shipped as two packages: one for Shopware 6.5 and 6.6, one for Shopware 6.7.
Constant-time signature checks, per-transaction locking, idempotent webhooks and HTTPS-enforced callbacks — documented, not implied. Two packages cover Shopware 6.5/6.6 and 6.7.
You will be redirected to the Coriunder secure payment page to complete your order.
An asynchronous redirect payment handler built on Shopware’s own DAL and lock primitives.
The shopper pays on Coriunder’s page and returns to your store. The plugin produces no HTML output — only redirects and JSON responses.
Webhooks are verified with a SHA-256 signature compared using hash_equals(), so a forged callback is rejected.
hash_equals()
An idempotency guard skips transactions already in a terminal state, and a per-transaction lock returns HTTP 429 to concurrent duplicates.
Reply 000 sets the transaction to paid, 553 leaves it awaiting the follow-up webhook, and anything else marks it failed.
000
553
All persistence goes through Shopware’s Data Abstraction Layer with parameterised queries — no hand-built SQL.
Package A targets Shopware 6.5/6.6 on PHP 8.1+ with the legacy asynchronous payment API; Package B targets 6.7 on PHP 8.2+.
An asynchronous payment flow, settled by a verified webhook.
The payment method appears at checkout once the plugin is installed, activated and assigned to your sales channel.
Shopware redirects to the Coriunder payment page with an HTTPS-enforced return and notification URL.
The return URL is generated by Shopware core rather than supplied by the request, closing off open-redirect abuse.
Coriunder POSTs to /coriunder/webhook. The signature is verified, the transaction is locked, and the state is set.
/coriunder/webhook
Each concern below is paired with the mitigation actually implemented in the plugin, from forged webhooks through to log injection. It is the same table published in the technical documentation.
Debug logging writes to var/log/ and contains no customer PII and no personal hash. Disable it in production.
var/log/
trans_id
reply_desc
Current release: 1.1.2, published as two packages.
hash
openssl
POST https://your-store.com/coriunder/webhook
Upload it in the admin, or install it from the console.
Choose the 6.5–6.6 archive or the 6.7 archive to match your Shopware version.
Go to Extensions → My Extensions → Upload Extension, then Install and Activate.
Copy the folder to custom/plugins/ and run plugin:refresh, then plugin:install --activate CoriunderHostedGateway.
custom/plugins/
plugin:refresh
plugin:install --activate CoriunderHostedGateway
Enter the Merchant ID, Payment Page URL and Personal Hash, choose the payment page language and transaction type, and enable the gateway.
Package A for Shopware 6.5.x and 6.6.x on PHP 8.1+, Package B for Shopware 6.7.x on PHP 8.2+.
The idempotency guard skips transactions already in a terminal state, and a per-transaction lock returns HTTP 429 to a concurrent duplicate.
3-D Secure is still in progress. The transaction state is left unchanged until the follow-up webhook arrives.
en-GB, en-US, he-IL, ru-RU and de-DE.
en-GB
en-US
he-IL
ru-RU
de-DE
The payment method is deactivated but not deleted, preserving the payment records on existing orders. Remove the files afterwards with bin/console plugin:delete CoriunderHostedGateway.
bin/console plugin:delete CoriunderHostedGateway
No. Debug logging excludes customer PII and never records the personal hash. It should still be disabled in production.
Download the package that matches your Shopware version and connect your store to Coriunder.