What is a good and secure web payment architecture

Question

I'm running a transactional web site where client pay for goods. As of now, I'm using my payment processor (pp) company web page to handle the payment, ie the client is redirected to the PP server and redirected back to my site when the payment done. A big disadvantage is that I can't customize the PP page, or very little.

Now, I want to handle the payment directly on my web site. I just need to post all the payment data to my payment processor an it returns the response. I already know that I need to be PCI compliant. My website is done using AJAX calling RESTeasy WebServices and a Java server.

Now my question is, should I validate every fields on the client side, using javascript, or swing everything on the server and do the job there? Should I POST to the payment processor directly using a FORM on the client or using an HttpUrlConnection from the server? What is the benchmark on the market for doing this? I found a lot of PHP example but unfortunatly a don't have time to learn PHP.

Thanks

Answer 1

As pointed out, you cannot validate only on the client because people can take your client code and modify it. In addition, you'll need to provide account information, which you wouldn't want to be visible to users. Your server must validate and process the request.

This is a fairly complex task. You need to ensure the page is accessed through SSL (HTTPS), and you need to securely access your credit card processor.

You can perform some basic validation from your server-side code. Check out http://www.blackbeltcoder.com/Articles/ecommerce/validating-credit-card-numbers .

Beyond that, it's really up to your processor and the API they make available to you. You'll need to write code that conforms to their specification.

Answer 2

Whether you want to POST data directly to the payment processor or collect the credit card information depends on your payment processor and if you want to store some of the information you collect on the credit card page ( don't store the credit card information; store only the last four digits if you need to.)

Posting the form directly to the payment processor is the simplest way. It probably also means that you don't even need to be PCI level 4 compliant, because none of the credit card information ever passes through your system. See here:

http://www.pcicomplianceguide.org/pcifaqs.php#2

On the other hand, if you want to store the billing address or the last four digits of the credit card number - or to insert this data into a receipt that you want to send by e-mail - you will need to write your own server-side code that collects the information from the credit card page and POSTs the data to the payment processor using an HttpUrlConnection. If your payment processor offers an API, you could also use that.

In either case, you should make sure that your payment page can only be viewed over SSL. In a Java web application, you can use a transport-guarantee entry in web.xml to do this:

  <security-constraint>
   <user-data-constraint>
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>
   </user-data-constraint>
   <web-resource-collection>
     <url-pattern>your_payment_page.jsp</url-pattern>
   </web-resource-collection>
  </security-constraint>

This will make sure that even if a user accesses your payment page on plain HTTP, the application server will redirect to HTTPS.

This page (from a payment processor I've dealt with) has some more information, from a processor point of view:

http://wiki.usaepay.com/developer/transactionapi

Answer 3

Thanks to all of you for your answers. Finally, it's far more complicated, and it's a too big responsibility to take care of collecting the payment data myself just for the purpose of web page design. I will still modify my payment page, informing the users that they will be redirected on the payment processor web page to complete the payment. Kind of an hybrid of what I have now. This is safer for them and for me.

Thanks again.