发布带有“秘密”的表格来自服务器的数据并在用户浏览器中打开结果
我正在使用外部支付网关构建一个简单的支付流程。
- 用户选择产品，点击“购买”，
- 服务器发出 POST 请求以从第 3 方站点加载支付页面。
支付网关不知道“产品”是什么，并且期望具有实际价格值的请求。这让我很恼火，因为这意味着能够查看源代码的人将看到请求字段和值。有些人可能会试图搞乱价值观和排序系统。这并不是一个大问题，订单确认无论如何都会使用令牌进行身份验证，但这不会阻止聪明人搞乱值并进行付款。
有没有办法通过从服务器发布数据并在用户浏览器中打开结果来请求网关页面？
如果他们必须通过用户的浏览器，那么有什么更晦涩的方法来做到这一点？在响应中使用 HTTP 标头？使用 AJAX 调用发帖？
谢谢。
PS：这不是要进行默认服务器发布（即使用curl），结果页面必须在用户的浏览器中打开。
PPS：好吧，在对支付网关 API（准确地说是 Payline.com）进行了更多研究后，我发现他们确实为此提供了一种机制，其中服务器发布帖子，返回令牌，然后用户继续到填写所有内容的页面。浏览器没有发送数据，这正是我想要的。这是我的问题的解决方案，但不是这个问题的答案。我不会将此作为答案发布，但我仍然认为有答案会很好。
I am building a simple payment process using an external payment gateway.
- The user chooses a product, clicks Buy,
- The server makes a POST requests to load the payment page from the 3rd party site.
The payment gateway has no idea what "products" are, and expects a request with an actual price value. This rubs me the wrong way, as it would mean that someone able to view source will see the request fields and values. Some would be tempted to mess up with the values and the ordering system. Not that this is a huge problem, the order confirmation will anyway be authenticated with a token, but it will not stop smart guys to mess up the values and make a payment.
Is there are way to request the gateway page by posting the data from the server and open result in user browser?
If they have to go through the user's browsers, what would be a more obscure way to do it? Playing with HTTP headers in the response? Posting with an AJAX call?
Thanks.
PS: This is not about making an tacit server post (ie with curl), the resulting page must open in the user's browser.
PPS: Well, after playing a bit more with the payment gateway API (Payline.com to be precise) I discovered that they do provide a mechanism for this, where the post is made by the server, a token is returned and the user goes to the page with everything filled in. The browser is not sending the data, which is just what I wanted. It's the solution to my problem but not the answer to this question. I won't post this as an answer and I still think it would be nice to have an answer.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是可能的，但它高度依赖于支付网关供应商的 API，因此不可能为您提供量身定制的答案。话虽这么说，有几种方法可以做到这一点。
HTTP 标头不是实现此目的的方法。 AJAX 调用也不是。两者都非常容易被篡改。最好的办法是简单地验证订单与收到的金额，如果它们不匹配超过一个小（+/-1%）误差幅度，则冲销费用，以考虑四舍五入等问题。如果有人弄乱了结果，他们的钱会在几天后退还（因为退钱通常比收费慢。）
第二种方法是使用curl来进行（正如你所说的）默认服务器发布，并且然后将结果返回给用户 - 实际上充当支付网关和您的客户之间的代理。这可能不像第一个解决方案那么好。
基本上，解决这个问题的方法是加强簿记。无论您如何努力保护通信安全，通过用户浏览器的任何内容都会在某一时刻被篡改。只要确保你的系统足够聪明，能够在发生有趣的事情时闻到它的气味。
This is possible, but it's so highly dependent on the payment gateway vendor's API that it is not possible to give you a tailored answer. That being said, there are a few ways to do it.
HTTP headers are NOT the way to do it. Neither is an AJAX call. Both are eminently easy to tamper with. The best thing to do is simply to verify the order with the amount received, and reverse the charge if they don't match by more than a small (+/-1%) margin for error, to account for rounding and whatnot. If someone messes with the results, their money comes back minus a couple days (as returning money is often slower than charging it.)
The second way to do it would involve using curl to make the (as you say) tacit server post, and then returning the results to the user - in effect acting as a proxy between the payment gateway and your customers. This probably isn't as good a solution as the first one.
Basically, the solution to this is strong bookkeeping. Anything that goes through the user's browser at all is going to get tampered with at one point or another, no matter how much you try to secure your communications. Just be sure your system is smart enough to smell it when funny business goes on.
你能做的就是通过你自己的服务器代理POST请求。向用户显示包含价格和所有字段的支付页面，但不是直接发送到支付网关的
Submit操作，您可以拦截服务器上的提交操作，然后向支付网关服务器端发出请求验证它。What you can do is to proxy the POST request through your own server. Show the payment page with price and all fields to the user but instead of
Submitaction going directly to the payment gateway you can intercept the submit action on your server and then make the request to payment gateway server side after verifying it.