#stephendalygds_68993

1 messages · Page 1 of 1 (latest)

atomic thunderBOT
midnight quiver
#

Hi 👋

Yeah we don't really document this path but give me a minute to look

bleak trellis
#

Yep, here's one req_RQqW8nNXKLSbxR

midnight quiver
#

Are you using the stripe-java client library?

bleak trellis
#

We are not, but it looks like there isn't specific support for this request in the Java library, you can just provide a Map<String, Object> for the requests params which is similar to what we are doing.

midnight quiver
bleak trellis
#

I just tried this, but got the same error - see req_LJefbSKK8RXZNj

My code looks like this:

        TokenCreateParams tokenCreateParams = TokenCreateParams.builder()
                .putAllExtraParam(Map.of("pk_token", paymentToken,
                        "pk_token_instrument_name", applePayPaymentData.getPaymentInfo().getDisplayName(),
                        "pk_token_payment_network", applePayPaymentData.getPaymentInfo().getNetwork(),
                        "pk_token_transaction_id", applePayPaymentData.getPaymentInfo().getTransactionIdentifier()))
                .build();
        return Token.create(tokenCreateParams, requestOptions);```
midnight quiver
bleak trellis
midnight quiver
#

Okay so what we are looking for in the request to /v1/tokens is

pk_token=<PKPaymentToken.paymentData decoded as JSON> \
pk_token_instrument_name=<PKPaymentToken.paymentInstrumentName> \
pk_token_payment_network=<PKPaymentToken.paymentNetwork> \
pk_token_transaction_id=<PKPaymentToken.transactionIdentifier>
bleak trellis
#

If I try to send a map rather than a String for the pk_token I get a different error, which would suggest to me that the request format is correct.

atomic thunderBOT
midnight quiver
#

Yes if the pk_token parameter were the problem we would expect a different error

#

I'm trying to understand the source of this error. I was hopeful it had to do with some SSL cert and that the stripe-java library would help

bleak trellis
#

My guess was the error message is referring to the Apple Pay Payment Processing certificate, is it not?

midnight quiver
#

But it does look like the error is coming from the cryptogram validation process

bleak trellis
#

Are there any clues as to where it's failing? Are the contents of pk_token as expected? I've already tried regenerating the Payment Processing Certificate with Apple and uploading the new one to Stripe. I also tried creating a new Merchant ID as suggested on https://stripe.com/docs/apple-pay/apps#troubleshooting

midnight quiver
#

Question: Is this an existing application or are you building something brand new?

#

Because this error is due to the ApplePay certificate

bleak trellis
#

We already have a Stripe integration, we're just trying to add Apple Pay now

midnight quiver
#

Okay so this issue is with the certificate. You need to get the CSR from the Stripe Dashboard and use it to generate the ApplePay token

bleak trellis
#

I have done this

midnight quiver
#

Taking a look at the ApplePay cert with my colleagues

bleak trellis
#

Thanks!

midnight quiver
#

Okay we think this is a certificate mismatch. How are you collecting the Apple Pay? Is this an iOS app or a web page integration?

bleak trellis
#

It's a web page integration

midnight quiver
#

Are you calling this method? ApplePaySession.canMakePaymentsWithActiveCard?

If so can you share the code?

bleak trellis
#

I've verified that we are using the same Merchant ID for the running code as for the certificate uploaded to the Stripe dashboard

midnight quiver
#

Thanks, looking into this

#

Okay can you verify that the mechantIdentifier value in your back-end code that requests the Payment Session from Apple matches the value in the ApplePay certification?

#

The value needs to match the apple_merchant_name on the certificate you uploaded to Stripe

bleak trellis
#

I have verified this is the case

midnight quiver
#

You see merchant.uk.gov.service.payments.stripe.local in your back-end?

#

Sorry if it seems repetitive, I just want to make sure we check everything

bleak trellis
#

We validate the session with Apple Pay using the onvalidatemerchant event handler. This calls our backend here https://github.com/alphagov/pay-frontend/blob/master/app/controllers/web-payments/apple-pay/merchant-validation.controller.js#L31 which makes a request to Apple Pay to validate the session. You can see we we are providing the merchant ID and merchant identity certificate here.

I added some logging and can see the merchant ID is the same as for the certificate uploaded to Stripe: "merchantIdentifier":"merchant.uk.gov.service.payments.stripe.local"

GitHub
pay-frontend/app/controllers/web-payments/apple-pay/merchant-valida...

Payments Frontend application in NodeJS. Contribute to alphagov/pay-frontend development by creating an account on GitHub.

#

Is there any way I can validate the CSR I downloaded and uploaded to Apple matches the private key that Stripe holds? Does the CSR regenerate each time I try to add an Apple Pay application in the Stripe dashboard? Is there any chance this has got out of sync?

#

I could try doing this again, but I have already tried recreating the certificate once before

midnight quiver
#

Okay after some digging we suspect something is getting messed up in the pk_token value being passed in. The errors appear to be coming from the validation of the token.

Our API redacts the pk_token value in the API logs so all you see is ****** but for testing purposes you can change that parameter to pk_token_debug and make another request and then both you and we will be able to view the string passed in to see if anything is getting messed up there.

bleak trellis
#

Ah great! I'll try that

atomic thunderBOT
bleak trellis
#

The error has changed, it now says parameter_missing. But you can see the contents of the pk_token: req_rqunXwhyDQbYtM

midnight quiver
#

You send the data from the client back to your server to request the Session?

bleak trellis
#

Yes, we are doing that

midnight quiver
#

Okay, I just wanted to make sure. Still reviewing the contents of pk_token_debug

bleak trellis
#

Thanks

midnight quiver
#

Okay. Can you clarify what creates the applePayPaymentData object you call getApplePayEncryptedPaymentData() from?

#

At this point our best guess is something is going wrong with the character encoding

bleak trellis
#

It's coming from the PKPaymentToken returned by Apple but it is sent from of our apps to another. I have tried logging the contents as soon as we get the PKPaymentToken from Apple and compared it to what we're sending to stripe in "pk_token", and they are equal - just the ordering of the properties in the JSON have changed.

midnight quiver
#

Okay this rules out the data encoding issue we suspected.

#

At this point the only thing that it could possibly be is that Apple is encrypting the the data using a different certificate than the one you have uploaded to Stripe.

#

Is there any possibility that there are conflicting certificates in the different apps? Or could your hosting environment be caching the certificate being used?

west dragon
#

👋 Hello! I've been working with @midnight quiver on this behind the scenes. I'm taking over so he can step away for lunch.

#

I've been looking through our code and the only thing I can think of that would explain this is a certificate mismatch. Specifically we can't verify the PKCS7 digest.

bleak trellis
#

Hi @west dragon, thanks. We don't host the processing certificate - it's only in Apple, where we can only have one active processing certificate per Merchant ID and in Stripe

west dragon
#

Right, but Apple also has it. Is it possible they have the wrong one?

bleak trellis
#

Is there any way I can veify the certificate I've got uploaded to Apple with the private key/CSR that Stripe havE?

#

I can try downloading a new CSR from Stripe and regenerating the certificate with Apple, but I have already done this once

west dragon
#

I'm not sure, it's been a while since I logged in to Apple's developer portal. What info do they give you there about the certificate being used?

bleak trellis
#

They just give the merchant ID name and expiry date in the portal. But I can download the certificate, which I did when I uploaded to Stripe

west dragon
#

🤔

#

Earlier you said:

I have tried logging the contents as soon as we get the PKPaymentToken from Apple and compared it to what we're sending to stripe in "pk_token", and they are equal - just the ordering of the properties in the JSON have changed.
Just to confirm, you were logging that client-side, correct?

bleak trellis
#

Ah no, it was server-side actually. I can try adding in client-side logging to double check

west dragon
#

That sounds good. I'm worried there might be a subtle encoding error when going from client to server.

#

Maybe something is getting URL encoded in the wrong place or something like that.

bleak trellis
#

Ok I think you might have led me to the solution. I've tried sending the apple pay PKPaymentToken data as a String between our apps rather than as JSON, and I've finally got a success response creating a token - so it was probably something to do with the encoding!

west dragon
#

Ah ha!

bleak trellis
#

There must have been some difference that wasn't visible when I was logging the payload in the 2 places

#

Thanks so much! I think we can call this resolved

west dragon
#

Awesome to hear it's working now! The data Apple provides is very picky/fragile when it comes to encoding and any kind of transformations (like JSON encoding), so this makes sense. Enjoy the rest of your day!

bleak trellis
#

Thank you! You too!

#

One more question I have, that is maybe quicker to answer - do you know any way to test a Google Pay payment that requires 3D secure?

west dragon
#

Do you have a custom Google Pay integration as well?

#

Or are you using Stripe's?

bleak trellis
#

Also a custom Google Pay integration. We have that working, we're just hoping for a test card or magic value that will trigger 3D secure for the payment intent.

west dragon
bleak trellis
west dragon
#

I think those all produce transactions with a cryptogram, correct?

bleak trellis
#

Ah maybe, I'm not too familiar with the google pay integration. How would we start a pan_only transaction?

west dragon
#

I'm not either, but looking... 🙂

#

But... how? 😅

bleak trellis
#

Ah ok, so we'd probably have to hardcode some test data, rather than being able to test end-to-end with our deployed app?

west dragon
#

I think so, if you specifically want to force Stripe to trigger 3D Secure in test mode.

bleak trellis
#

Ah ok, thanks. And there's no way we could force Stripe to request 3DS for a payment intent using some value other than the card number such as the cardholder name or some other field?

west dragon
#

You can do it with a custom Radar rule if you have Radar for Fraud Teams.

bleak trellis
#

Ah we do not have Radar for Fraud teams

west dragon
#

I think you can turn it on in test mode to try it out without paying for it.

bleak trellis
#

Ah yes I can see there is a custom rule there we set up for testing, so should be able to use that

#

Thanks, I'll give that a go with custom rules tomorrow

#

Thanks again for all your help