globalpayments / globalpayments-3ds-js

Helper library for leveraging 3DSecure 2 for Strong Customer Authentication (SCA)
https://www.npmjs.com/package/globalpayments-3ds
GNU General Public License v2.0
5 stars 10 forks source link

Using a REST API? #5

Closed csdougliss closed 5 years ago

csdougliss commented 5 years ago
const versionCheckData = await checkVersion('/3ds2/check3dsVersion', {
        methodNotificationUrl: 'http://example.com/3ds2/methodNotification',
        card: {
          number: document.getElementById('card-number').value,
        },
      });

Can the checkVersion work with REST APIs?

footfish commented 5 years ago

Can the checkVersion work with REST APIs?

You'd have to be more specific in what you mean. checkVersion will send an API request to the endpoint /3ds2/check3dsVersion with a request payload in the format
{"methodNotificationUrl":"http://example.com/3ds2/methodNotification", "card":{"number":"4263970000005262"}} .... that looks like a restful request but the server is returning "serverTransactionId": "279ed4cd-6ef1-44f2-aa49-d6d7c376606f" (as part of the response) which indicates state is stored on the server therefore it's not REST (as not stateless).

csdougliss commented 5 years ago

@footfish I am developing the integration for Magento 2.

https://devdocs.magento.com/guides/v2.3/extension-dev-guide/service-contracts/service-to-web-service.html

So far I have created a REST api to check3dsVersion.

e.g.

serviceUrl = urlBuilder.createUrl('/realex-payments/:quoteId/check-3ds-version', {
                        quoteId: quote.getQuoteId()
                    });
                    payload = {
                        cartId: quote.getQuoteId(),
                        paymentMethod: this.getData()
                    };

fullScreenLoader.startLoader();

                await storage.post(
                    serviceUrl, JSON.stringify(payload)
                ).done(function (response) {
                    if (response) {
                        var versionCheckData = JSON.parse(response);
                        version = versionCheckData['check3ds_version_version'];
                    }
                }).fail(function (response) {
                }).always(function () {
                    fullScreenLoader.stopLoader();
                });

I was just wondering if I could use you code and instead:

const versionCheckData = await checkVersion('/3ds2/check3dsVersion', {
        methodNotificationUrl: 'http://example.com/3ds2/methodNotification',
        card: {
          number: document.getElementById('card-number').value,
        },
      });

But I think I may have not build a REST api and instead just create a controller that gets $_REQUEST params insteads, so it works correctly with your JavaScript?

slogsdon commented 5 years ago

@craigcarnell As @footfish noted, the library will POST a JSON request (Content-Type: application/json) to your endpoint to check the 3DS version and initiate authentication. This should be REST compatible in cases where API credentials aren't needed. We don't currently expose a way to configure credentials for the POST, but if you need something like this, you can always handle the initial POST requests yourself and pass the result to handle3dsVersionCheck and handleInitiateAuthentication to let the library handle the necessary UI/DOM logic.

footfish commented 5 years ago

@craigcarnell If I was going to use globalpayments-3ds-js lib on client side then i'd go the controller route to build a custom api on your Magento server that will support on all required globalpayments-3ds-js calls. I'd do this for the following reasons 1) the api is not being designed for general exposure (ie. it only has to interact with globalpayments-3ds-js), 2) Have to adhere to the rules set out be Magento's webapi will likely cause you unnecessary headaches 3) the globalpayments-3ds-js api is relatively simple and 4) subsequent calls like method notification are less like a typical REST api (response is Githubissues.

  • Githubissues is a development platform for aggregating issues.