search

digital-pros / commerce-authorize

Authorize.net - Craft Commerce 2 Plugin
Other
3 stars 9 forks source link

"Invalid OTS token" when saving a payment source using Accept.js #19

Closed elivz closed 4 years ago

elivz commented 4 years ago

Describe the bug When using Accept.js on the front-end and with the savePaymentSource option set on the cart, the gateway throws an "Invalid OTS Token" error upon trying to complete the order. I believe this is because the gateway plugin uses the one-time token first to create the saved card in CIM (https://github.com/digital-pros/commerce-authorize/blob/master/src/gateways/Gateway.php#L397) and then uses the same token again to authorize the transaction (https://github.com/digital-pros/commerce-authorize/blob/master/src/gateways/Gateway.php#L178). The second request fails because the token has already been used.

My understanding is that either the customer payment profile needs to be created in the same request as the payment authorization, or if they are to be two separate steps the second one needs to use the 'customerProfileId' in place of the token.

To Reproduce Steps to reproduce the behavior:

  1. Enable Accept.js on the front-end
  2. Create a test order an enter credit card information at checkout. Select the "Save payment information" checkbox (<input type="checkbox" name="savePaymentSource" value="1">).
  3. Submit payment form.
benlobach commented 4 years ago

Hello @elivz!

Thanks for filling out an issue! It doesn't look like we can replicate this error in our clean staging environment, and we haven't seen something like this in the past.

A couple of quick questions:

Let me know what you find out and we'll dig a bit deeper, if needed!

elivz commented 4 years ago

I tried installing the default templates and comparing the POST data from both versions. After some trial and error, it seems that the transaction fails if there is an orderNumber field in the POST data, containing the current cart's number. No idea why...I can't find any place in the code where that would seem to matter. But removing that hidden input has fixed the error.

benlobach commented 4 years ago

Thanks for following up with what you found! The additional Order ID was most likely passed all the way to Authorize.net through the Omnipay gateway and Authorize.net didn't know what to do with that information. Let me know if anything else comes up!