Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Payment card / Subscription] make backend 3DS code not rely on Web-Secure #46144

Closed
blimpich opened this issue Jul 24, 2024 · 9 comments
Closed
Assignees

Comments

@blimpich
Copy link
Contributor

blimpich commented Jul 24, 2024

#44795 made it so that our backend communicated with the new dot frontend in order to properly authenticate a user using stripe's 3DS/SCA flow, but it hinged on modifying a file in web-secure in order for this to work. This is a problem for 2 reasons:

  1. we want to minimize using Web-Secure since we would like to get rid of it entirely one day
  2. this makes it difficult/cumbersome for contributors to test our 3ds flow locally even with access to our ngrok endpoints, since hitting the secure repo requires using a different ngrok endpoint

So its in our best interest to migrate this code over to web.

@blimpich
Copy link
Contributor Author

Will require changing the returnUrl in the stripe class in Auth as well to not hit the secure endpoint, and instead in the normal web-expensify one. Most of the work will be in moving the necessary code from web-secure to web-expensify though.

@blimpich
Copy link
Contributor Author

Also probably want a web-secure PR to get rid of all the code that won't be used anymore

@blimpich
Copy link
Contributor Author

Starting working on this a bit today, got some draft PRs up. Struggling to get it to actually work locally though. Tricky flow to debug, but working through it.

@melvin-bot melvin-bot bot added the Overdue label Jul 29, 2024
@blimpich
Copy link
Contributor Author

Not overdue, was the weekend.

@melvin-bot melvin-bot bot added Overdue and removed Overdue labels Jul 29, 2024
@blimpich
Copy link
Contributor Author

Not overdue, was on vacation

@melvin-bot melvin-bot bot removed the Overdue label Jul 31, 2024
@blimpich
Copy link
Contributor Author

blimpich commented Aug 1, 2024

Couldn't get to this today, was busy doing chores. Will try to get to this tomorrow.

@blimpich
Copy link
Contributor Author

blimpich commented Aug 2, 2024

Worked on this a bit today, no major progress, still stuck trying to unbreak Old Dot. Only had a little bit of time to focus on this today though, so hoping a quiet Friday tomorrow will give me time to get through it.

@blimpich
Copy link
Contributor Author

blimpich commented Aug 2, 2024

I may have found a work around that would make all these PRs not needed. Currently trying to test this with a contributor.

@melvin-bot melvin-bot bot added the Overdue label Aug 5, 2024
@blimpich
Copy link
Contributor Author

blimpich commented Aug 5, 2024

Was able to figure out a workaround for this. Figured out issue in this slack thread.

So the solution was to change the return url auth is giving stripe to be the ngrok url, and also I had to delete most of callback.php in web-secure. This works for testing purposes for 3DS.

Closing as this is no longer needed.

@blimpich blimpich closed this as completed Aug 5, 2024
@github-project-automation github-project-automation bot moved this from Polish to Done in [#whatsnext] #wave-collect Aug 5, 2024
@melvin-bot melvin-bot bot removed the Overdue label Aug 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
No open projects
Status: Done
Development

No branches or pull requests

1 participant