search

CheckoutFinland / psp-api

5 stars 5 forks source link

/tokenization/addcard-form #59

Closed tssge closed 4 years ago

tssge commented 4 years ago

Trying to make /tokenization/addcard-form form with the provided instructions will lead to an error page. Sending as a JSON request will complain of invalid signature (and other missing params).

Can you provide an example how the form is supposed to be generated?

Also one would expect there to be a signature of some sort for posting the form.

According to the instructions, its expected for the form to resemble the following:

<form action="https://api.checkout.fi/tokenization/addcard-form" method="POST">
    <input type="hidden" name="checkout-account" value="375917" />
    <input type="hidden" name="checkout-algorithm" value="sha256" />
    <input type="hidden" name="checkout-redirect-cancel-url" value="http://localhost/testcard" />
    <input type="hidden" name="checkout-redirect-success-url" value="http://localhost/testcard" />
    <input type="submit" />
</form>

But this will only lead to an error page.

Keksike commented 4 years ago

Hey @tssge, and thanks for your issue report.

If I understood correctly, you are missing the authentication headers (when POSTing JSON) as defined here https://checkoutfinland.github.io/psp-api/#/?id=authentication

Let me know if adding those fixes it for you. I'll try to improve the documentation regarding the /tokenization/addcard-form API & authentication.

Keksike commented 4 years ago

Sorry, my previous answer is a bit incorrect.

But yeah, I guess you are indeed missing the authentication in the form post, and our documentation is lacking the required auth fields.

Here is sample code which creates the addcard-form request, hopefully this helps for now before I fix the docs: https://gist.github.com/Keksike/a5941770c5da41f539788f28cdd01777

tssge commented 4 years ago

Thank you very much for such a detailed example!

Didn't realize that the body is signed the same way as headers are signed with normal Checkout Finland API calls. Maybe this should be included in the documentation.

As normally according to the documentation request body is signed "as is".

Keksike commented 4 years ago

Glad to hear that it started working now!

Didn't realize that the body is signed the same way as headers are signed with normal Checkout Finland API calls. Maybe this should be included in the documentation.

Agree, our documentation is lacking, gotta fix that 👍