search

Adyen / adyen-cse-web

[DEPRECATED] Client-side encryption on JavaScript
MIT License
15 stars 39 forks source link

Support for device fingerprinting in JavaScript-only solution #48

Closed lennartp closed 7 years ago

lennartp commented 7 years ago

When using adyen.nodom.js it's currently not possible to add a device fingerprint to the encrypted data object.

adyen.nodom.js doesn't include adyen-hpp.df.js, so the dfValue attribute is always set to an empty string here: https://github.com/Adyen/adyen-cse-web/blob/master/js/adyen.encrypt.nodom.js#L471 .

try {
  data.dfValue = df();
} catch (e) {          
}

Note: df() is a function returning an empty string)

It would be very useful to be able to get the fingerprint separately and pass is to the encrypt method (without it being reset to an empty string).

ArnoudAdyen commented 7 years ago

When device fingerprinting is needed in a adyen.nodom.js scenario, the best is to follow https://docs.adyen.com/developers/revenueprotect#submittingthedevicefingerprint

You can include the df.js script, call the dfDo(..) and add the value from the hidden input to your payment request, apart from the encryption integration.

The reset on dfValue is in the code, because we prefer to be able to distinguish between a CSE library generated fingerprint and a fingerprint from non library code. Even though the fingerprint implementation might still be Adyen originated, there is no way to 100% trust that. As such the dfValue is reserved for library internal fingerprints and needs to be reset in this fashion.