1

I intend to use eWay as payment gateway but encounter problem after problem in implementing it.

As I don't want to touch credit card details at any point, not storing nor transfering via my site due to PCI requirements, I need to redirect users to page hosted by gateway. Users provide all the details there and gateway returns result confirmation to the page I specified, lets call it payment_done.php.

Now, in payment_done.php I dont know for sure if the confirmation came back from payment gateway itself or someone just POSTed it to my page and its a fake. So my page might receive confirmation, but payment might not be done at all.

Now in payment_done.php I need to ask eway then if this confirmation I received (with some specific transaction ID) came from them and if so the amount is right etc. Eway will return true/false back to me and then I can be sure payments been done for the right amount.

Now problem is that eway seems to allow to query for this confirmation only 100 times a day.

I seem to run out of ideas now and desperately seeking help. What options do I have left? It seems unbelievable that there is no way to make it work without falling into PCI compliance issues, even using payment gateway hosted page. Thanks in advance for any help.

4

1 回答 1

0

答案是双重的。

如果请求来自其他任何地方，则验证帖子是否来自 eway 服务器，则不允许该请求。这是您的主要安全形式。

如果 eway 有人想要入侵您的网站，请执行以下操作：

在向用户发送付款之前，请创建一个长哈希。您可以使用会话变量来保存它。

eWAYoption1使用参数传递哈希。

当 eway 回复一个答案时，检查该eWAYoption1值以验证它是否与当前用户的付款哈希匹配。

您必须在验证会话变量后立即删除它。即使散列错误，也要使会话变量无效并使它们重新开始。

在散列和验证发布 IP 地址之间，您应该非常安全。

于 2010-07-27T21:08:51.853 回答