You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Issue
When a payment gets processed it provides an order-id in the gateway_options to go to the gateway. Because of issue, spree/spree#1998 the sent order-idwas changed to be unique for each transaction. For some gateways this is important so multiple transactions against the order do not get rejected as a duplicate. (see issue.)
# The unique identifier to be passed in to the payment gateway
defgateway_order_id
"#{order.number}-#{number}"
end
However, for solidus_paypal_braintree this is a problem. Because they offer velocity checks, where for example you can set up a rule to reject the transaction if so many have been made with the same order-id.
We had a problem with credit card attacks and couldn't use this rule because the order-id was different even though the transactions belonged to the same order.
Would it be best for gateways/payment methods just to override this param themselves or have a configuration method?
moduleSpreeclassPayment < Spree::BasemoduleProcessing# The unique identifier to be passed in to the payment gatewaydefgateway_order_idifpayment_method&.consistent_gateway_order_id?order.numberelse"#{order.number}-#{number}"endendendendendmoduleSolidusPaypalBraintreeclassGateway < ::Spree::PaymentMethoddefconsistent_gateway_order_id?trueendendend
The text was updated successfully, but these errors were encountered:
RyanofWoods
changed the title
Not all gateways want a payment gateways_order_id to change per order transactions
Some gateways want the gateway order_id to be consistent for transactions on the same order
Dec 10, 2021
Issue
When a payment gets processed it provides an
order-id
in thegateway_options
to go to the gateway. Because of issue, spree/spree#1998 the sentorder-id
was changed to be unique for eachtransaction
. For some gateways this is important so multiple transactions against the order do not get rejected as a duplicate. (see issue.)solidus/core/app/models/spree/payment/processing.rb
Lines 124 to 127 in f4b6de0
However, for solidus_paypal_braintree this is a problem. Because they offer velocity checks, where for example you can set up a rule to reject the transaction if so many have been made with the same
order-id
.We had a problem with credit card attacks and couldn't use this rule because the
order-id
was different even though the transactions belonged to the same order.Would it be best for gateways/payment methods just to override this param themselves or have a configuration method?
Additional context
I am writing this as part of the bigger issue on
solidus_paypal_braintree
:solidusio/solidus_paypal_braintree#309
The text was updated successfully, but these errors were encountered: