| 3 | | "i can understand your issue with this although i am looking for an alternative" |
| 4 | | The Implementation engineers response. |
| 5 | | |
| | 4 | He also went on to confirm that the "Confirm WebCheckout Transaction" is just to confirm transaction status and that it doesn't have any sensitive information that can be used against us and it should be called from backend. |
| | 5 | He said the "Confirm WebCheckout Transaction" performs the same function the "Requery CollegePAY History" button does. |
| | 6 | |
| | 7 | and that our payment item id is not part of the request and without it no one can use our gateway. |
| | 8 | he suggested that we don't make the call from the front end. |
| | 9 | |
| | 10 | I then made him to understand that it is visible to everyone and can be used by a BOT or other malicious intruders and also asked him the following questions ; |
| | 11 | 1. What if the call is made from the front end ? |
| | 12 | will it not spool amount and trans_ref from the customer's transaction ? |
| | 13 | 2. what do you mean by "but your payment item id is not part of the request and without it no one can use your gateway" |
| | 14 | |
| | 15 | he answered by saying that "the only informations there would be merchant code and asked |
| | 16 | what can a malicious entity use that for? |
| | 17 | |
| | 18 | answer 2. i mean that for someone to make a call to use your payment gateway they need payment item id and it is not a part of the get transactions call. |
| | 19 | |
| | 20 | however there is if i use your gateway to collect money elsewhere it will be settled to you. |
| | 21 | your concern with the platform is safety and i am telling you that the information that is sent and received as the information therein are merchant code, transaction reference and amount |
| | 22 | |
| | 23 | I asked him if it is possible for this "GET transaction" to be secured with a keyed-hash message authentication code (MAC) as we earlier mentioned ? |
| | 24 | He said it is not possible. |
| | 25 | |
| | 26 | i then inquired about the other alternative he said he is looking for, |
| | 27 | "what i was looking into doesn't work this is the way that works today |
| | 28 | if an update is made we will update you guys" his response . |
| | 29 | |
| | 30 | |
