search

LivotovLabs / 3DSView

Android UI component to process banking 3D Secure (MasterCard SecureCode / Verified By Visa) payment authorizations in Android apps.
Apache License 2.0
111 stars 51 forks source link

completeAuthorization called without required html form for 3D Secure with Continue button #18

Open waggyza opened 7 years ago

waggyza commented 7 years ago

In this case the 3D Secure page that is loaded into the WebView first asks your to press a "next" button. Once next is pressed the bank sends a USSD to the phone associated with your card. You then reply to the USSD, and the Webview shows a "CONTINUE" button. Once you press "continue" the redirect is caught. However the html that is sent to completeAuthorisation contains a pre-auth link with PaReq, TermUrl, MD, rather than the required form with MD & PaRes. Attached is the html that is caught. continueHtml.txt

waggyza commented 6 years ago

I am suspecting that the required post parameters are in an iframe which is not caught by the code.

waggyza commented 6 years ago

As I suspected the redirect was occurring in an iFrame so for this specific case amending the javascript to get the HTML of the iFrame sorted the issue: view.loadUrl(String.format("javascript:window.%s.processHTML(document.getElementById('authWindow').contentWindow.document.getElementsByTagName('html')[0].innerHTML);", JavaScriptNS));