什么是好的、安全的网络支付架构
我正在运行一个交易网站，客户可以在其中支付商品费用。截至目前，我正在使用我的支付处理器 (pp) 公司网页来处理支付，即客户端被重定向到 PP 服务器，并在支付完成后重定向回我的网站。一个很大的缺点是我不能自定义PP页面，或者说很少。
现在，我想直接在我的网站上处理付款。我只需要将所有付款数据发布到我的付款处理器，它就会返回响应。我已经知道我需要遵守 PCI 标准。我的网站是使用 AJAX 调用 RESTeasy WebServices 和 Java 服务器完成的。
现在我的问题是，我应该使用 javascript 验证客户端的每个字段，还是将所有内容放在服务器上并在那里完成工作？我应该直接使用客户端上的 FORM 还是使用服务器上的 HttpUrlConnection 发送到支付处理器？市场上这样做的基准是什么？我发现了很多 PHP 示例，但不幸的是我没有时间学习 PHP。
谢谢
I'm running a transactional web site where client pay for goods. As of now, I'm using my payment processor (pp) company web page to handle the payment, i.e. the client is redirected to the PP server and redirected back to my site when the payment done. A big disadvantage is that I can't customize the PP page, or very little.
Now, I want to handle the payment directly on my web site. I just need to post all the payment data to my payment processor an it returns the response. I already know that I need to be PCI compliant. My website is done using AJAX calling RESTeasy WebServices and a Java server.
Now my question is, should I validate every fields on the client side, using javascript, or swing everything on the server and do the job there? Should I POST to the payment processor directly using a FORM on the client or using an HttpUrlConnection from the server? What is the benchmark on the market for doing this? I found a lot of PHP example but unfortunatly a don't have time to learn PHP.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您是否想要将数据直接发布到支付处理器或收集信用卡信息取决于您的支付处理器以及您是否想要存储在信用卡页面上收集的一些信息（不存储信用卡信息；如果需要，仅存储最后四位数字。）
将表格直接发送到付款处理器是最简单的方法。这可能还意味着您甚至不需要符合 PCI 第 4 级标准，因为任何信用卡信息都不会通过您的系统。 ：
http://www.pcicomplianceguide.org/pcifaqs.php#2
请参阅此处 另一方面，如果您想存储帐单地址或信用卡号的最后四位数字 - 或者将此数据插入到您想要通过电子邮件发送的收据中 - 您将需要编写自己的服务器 -从信用卡页面收集信息并使用 HttpUrlConnection 将数据 POST 到支付处理器的辅助代码。如果您的支付处理器提供 API，您也可以使用它。
无论哪种情况，您都应该确保只能通过 SSL 查看您的付款页面。在 Java Web 应用程序中，您可以使用 web.xml 中的传输保证条目来执行此操作：
这将确保即使用户通过纯 HTTP 访问您的支付页面，应用程序服务器也会重定向到 HTTPS。
从处理者的角度来看，此页面（来自我处理过的支付处理者）提供了更多信息：
http://wiki.usaepay.com/developer/transactionapi
Whether you want to POST data directly to the payment processor or collect the credit card information depends on your payment processor and if you want to store some of the information you collect on the credit card page (don't store the credit card information; store only the last four digits if you need to.)
Posting the form directly to the payment processor is the simplest way. It probably also means that you don't even need to be PCI level 4 compliant, because none of the credit card information ever passes through your system. See here:
http://www.pcicomplianceguide.org/pcifaqs.php#2
On the other hand, if you want to store the billing address or the last four digits of the credit card number - or to insert this data into a receipt that you want to send by e-mail - you will need to write your own server-side code that collects the information from the credit card page and POSTs the data to the payment processor using an HttpUrlConnection. If your payment processor offers an API, you could also use that.
In either case, you should make sure that your payment page can only be viewed over SSL. In a Java web application, you can use a transport-guarantee entry in web.xml to do this:
This will make sure that even if a user accesses your payment page on plain HTTP, the application server will redirect to HTTPS.
This page (from a payment processor I've dealt with) has some more information, from a processor point of view:
http://wiki.usaepay.com/developer/transactionapi
正如所指出的，您不能仅在客户端上进行验证，因为人们可以获取您的客户端代码并对其进行修改。此外，您还需要提供您不希望用户看到的帐户信息。您的服务器必须验证并处理请求。
这是一项相当复杂的任务。您需要确保通过 SSL (HTTPS) 访问该页面，并且需要安全地访问您的信用卡处理器。
您可以从服务器端代码执行一些基本验证。查看 http://www.blackbeltcoder.com/Articles/ecommerce/validating -信用卡号码。
除此之外，这实际上取决于您的处理器以及它们为您提供的 API。您需要编写符合其规范的代码。
As pointed out, you cannot validate only on the client because people can take your client code and modify it. In addition, you'll need to provide account information, which you wouldn't want to be visible to users. Your server must validate and process the request.
This is a fairly complex task. You need to ensure the page is accessed through SSL (HTTPS), and you need to securely access your credit card processor.
You can perform some basic validation from your server-side code. Check out http://www.blackbeltcoder.com/Articles/ecommerce/validating-credit-card-numbers.
Beyond that, it's really up to your processor and the API they make available to you. You'll need to write code that conforms to their specification.
感谢大家的回答。最后，它要复杂得多，并且仅仅为了网页设计的目的而自己负责收集支付数据的责任太大了。我仍然会修改我的支付页面，通知用户他们将被重定向到支付处理器网页上以完成支付。有点像我现在所拥有的的混合体。这对他们和我来说都更安全。
再次感谢。
Thanks to all of you for your answers. Finally, it's far more complicated, and it's a too big responsibility to take care of collecting the payment data myself just for the purpose of web page design. I will still modify my payment page, informing the users that they will be redirected on the payment processor web page to complete the payment. Kind of an hybrid of what I have now. This is safer for them and for me.
Thanks again.