PSD2/3DSecure2/Sagepay v4 support

[jontjs]

Sagepay are beginning to publish information on the PSD2/3DSecure2 aspects of their V4 VPSProtocol: https://www.sagepay.co.uk/support/38/psd2-under-direct-integration .

At the time of writing they haven't linked to a new version of the full integration document at https://www.sagepay.co.uk/support/find-an-integration-document/direct-integration-documents, perhaps because v4 doesn't hit their Test environment until July 1st 2019, and their Live environment until "later in July") , but the docs are available at https://www.sagepay.co.uk/library/document/directintegrationandprotocol4guidelinespdf .

[BrockleyJohn]

@Sheaffy

colorDepth

What did you feed them instead of 30? 24??

[lukrak]

@BrockleyJohn I went for 24 because safari returns "24".

See google ticket

[mtjburton]

For what it's worth I raised this with Sagepay and received this:

The escalations team have advised to have your system hard code the 30 to nearest acceptted value to match the specification laid out by the new 3ds2 process, so that this information can be presented to banks within their specifications.

I've also set it to 24 as this is what other browsers are using and everything has been going through correctly.

[AColes]

I'm a bit late to the party here - am I missing something?

The latest/current version 3.2.2 does not seem to have any of the 4.00 related changes discussed here - it still puts '3.00' in for VPSProtocol, regardless of what's supplied and ignores all of the new/extra fields required for 4.00.

[benjam-es]

@barryvdh @judgej are there any plans for the package to implement the 4.00 requirements? I believe the deadline from September has been extended, but only until March 2022.

https://www.opayo.co.uk/support/sca-faqs

[lukrak]

How did anyone deal with the fact that SagePay requires you to pass customer's IP but you can only pass IPv4 in that field because IPv6 is too long for that field ? I think SagePay returns something like "Max length of 15 for ClientIPAddress"

[benjam-es]

How did anyone deal with the fact that SagePay requires you to pass customer's IP but you can only pass IPv4 in that field because IPv6 is too long for that field ? I think SagePay returns something like "Max length of 15 for ClientIPAddress"

When I called Opayo, the result of the conversation was that they didn't have IPv6 in the near future pipeline, so we fake it with 1.1.1.1 if the IP is IPv6 based.

In addition/alternatively, I used a setting within cloudflare to deal with is 'Pseudo IPv4', with overwrite headers.

[jamieburchell]

Is anybody working on/are there any branches/forks for SagePay Server v4? From looking at the changes, there are just some field length changes and new optional fields which must be used in the security key calculations.

Edit: I see this but don't know if it's ready/will be merged?

[bwdgroup]

How did anyone deal with the fact that SagePay requires you to pass customer's IP but you can only pass IPv4 in that field because IPv6 is too long for that field ? I think SagePay returns something like "Max length of 15 for ClientIPAddress"

When I called Opayo, the result of the conversation was that they didn't have IPv6 in the near future pipeline, so we fake it with 1.1.1.1 if the IP is IPv6 based.

In addition/alternatively, I used a setting within cloudflare to deal with is 'Pseudo IPv4', with overwrite headers.

Where can we find the same setting in CloudFlare ?

[benjam-es]

@bwdgroup Think there should be instructions somewhere here https://blog.cloudflare.com/eliminating-the-last-reasons-to-not-enable-ipv6/