具有 Activemerchant gem 的多个商家帐户
我正在开发一个 Rails 网站，该网站将允许一组商家（5 - 10）在线接受信用卡订单。我计划使用 Activemerchant gem 来进行处理。
在这种情况下，每个商家将拥有自己的商家帐户来处理付款。我不喜欢这样存储银行信息。这可以通过排队订单并允许商家登录网站、输入凭据并处理订单来解决。
然而，如果我走这条路，那么在我看来，我将不得不暂时存储客户的信用卡信息，直到商家有机会登录并处理订单，这对我来说是更大的罪恶。
有人处理过这种情况吗？如果是这样，有哪些可用选项以及我应该注意哪些陷阱？在我看来，安全的客户信用卡信息是第一要务，其次是商家帐户信息。
I am developing a rails site that will allow a group of merchants (5 - 10) to accept credit card orders online. I plan on using the Activemerchant gem to handle the processing.
In this case, each merchant will have their own merchant accounts to handle the payments. Storing banking information like that is not something I am a fan of. This could be solved by queing orders and allowing the merchant to log in to the site, input their credentials and process the order.
However, if I go that route then it seems to me that I would have to store the customers' credit card information temporarily until the merchant has the opportunity to log in and process the order, which to me is the greater evil.
Has anyone dealt with this situation? If so, what are the options available and what pitfalls should I look out for? In my mind, security customer credit card information is priority number one with the merchant account information a close second.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当您使用 ActiveMerchant 创建网关对象时，您可以指定商家的信息。因此，我认为您的软件可以代表多个商家进行交易。只需将他们的信息保存在数据库中并根据需要使用即可。我建议您对商家信息进行加密。
请参阅 gem attr_encrypted
我不知道为什么你不想存储商家的信息。也许你应该对此多说一些。
如果商户使用 Authorize.Net，您只需要每个商户的 Authorize.net 登录名和密码。
我建议您在单一支付网关（例如 Authorize.net 或其竞争对手之一）上对所有商家进行标准化。处理一个网关已经够困难的了，为什么要处理多个网关呢？此外，您还可以轻松成为authorize.net 的经销商，并简化商家的流程。
您是对的，您确实不想延迟信用卡交易，直到商家登录并提供其商家信息：
根据商家登录的频率，您将违反商家的卡协议及时收费和批量。
您无法向最终客户提供快速反馈 - 他们的收费是否成功？
您必须存储完整的信用卡号和其他信息。这需要高水平的 PCI 合规性。不值得。无论如何，您都被禁止存储 CVV 号码。因此，根据最终客户提供的其他信息，您的收费资格会较低（商家的交易成本较高）。
我的建议是存储商家的信息。 -- 对其进行加密，并且不要让商家（或其他任何人）看到它。只让商家替换他们的信息，不要让他们看到当前信息来编辑它。这将减少错误的人看到商家信息的安全风险。
When you create the gateway object with ActiveMerchant, you specify the merchant's information. So I'd think that it'd work ok for your sw to place transactions on behalf of multiple merchants. Just keep their information in a db and use as needed. I'd recommend that you encrypt the merchant's information.
See gem attr_encrypted
I'm not sure why you don't want to store the merchant's information. Maybe you should say more about this.
If the merchant is using Authorize.Net, you just need the Authorize.net login and password for each merchant.
I'd recommend that you standardize all of your merchants on a single payment gateway such as Authorize.net or one of their competitors. It's hard enough dealing with one gateway, why deal with more than one. Also, you can easily become a reseller for authorize.net and ease the process for your merchants.
You're right, you really don't want to delay the credit card transactions until a merchant login in and supplies their merchant info:
Depending on how often the merchant logs in, you'd be breaking the merchant's card agreement about timely charges and batching.
You'd have no way to provide speedy feedback to the end customer--did their charge succeed or not?
You'd have to store the complete credit card number and other information. That requires high level of pci compliance. Not worth it. And you are forbidden from storing the CVV number, no matter what. So depending on your other information from the end customer, your charges would have lower qualification (higher transaction costs to your merchants).
My recommendation is to store the merchants' information. -- Encrypt it and do not let a merchant (or anyone else) see it. Only let the merchants replace their info, do not let them see the current info in order to edit it. That will lessen security risk of the wrong person seeing the merchant's info.