I’m currently integrating Pay.jp’s 3D Secure as described in their documentation: Pay.jp 3D Secure Documentation.

I’ve set up the back_url as instructed for handling the redirect after 3D Secure authentication. However, when the user is redirected back to my back_url, I noticed that the request doesn’t include any signature.

My concern is how I can securely verify that the request coming back to my back_url is indeed from Pay.jp and not from a forged request.

Is there a way to verify this request, or am I missing something in the configuration? Should I manually verify the charge_id with Pay.jp’s API, or is there some other best practice for ensuring the authenticity of the request?