square / connect-api-specification

This repository contains the OpenAPI specification as well as templates for generating SDKs for Square's APIs
https://squareup.com/developers
Apache License 2.0
72 stars 35 forks source link

Incorrect context error message for mixed live/sandbox credentials #99

Closed jabcreations closed 6 years ago

jabcreations commented 6 years ago

I performed a test thinking I had changed all variables to the live credentials from the sandbox credentials. I changed the server-stored settings though not the client stored settings:

SERVER location id and token for live. CLIENT: applicationId and locationId were sandbox

I received the following error:

[0] => Array ( [category] => INVALID_REQUEST_ERROR [code] => NOT_FOUND [detail] => Resource not found. [field] => card_nonce )

I corrected the issues after noticing that the nonce was set and matched in the post from my server to yours what your server initially sent to my client browser first. An improvement in mixed credentials error handling would be appreciated by some others in the future.

brettstimmerman commented 6 years ago

Hi @jabcreations this is common situation, documented as an FAQ.

In practice it's difficult to determine when configuration wires are crossed, in order to provide a more meaningful error message.

jabcreations commented 6 years ago

Don't you folks handle all the validation in the same area of your code at your end? I'd imagine there would be an array and a primary key that the rest of the array items either correctly correlate with or don't so in that instance I'd throw a more appropriate error message however I do not know how you folks handle your server side code as that is internal to you.

brettstimmerman commented 6 years ago

When calling Charge, the logic in question is roughly:

Does the given card_nonce exist for the given application_id, and is it still valid (unused, unexpired, etc)?

If Yes: we have a match. Continue to process the Charge using this card_nonce. If No: we don't have a match. In other words, this card_nonce does not exist for this application_id. Return a Resource not found: card_nonce error.

At the time of the call to Charge, we by design don't know that the given card_nonce may be valid for another application_id.