31–40 of 58 posts
Earlier quoted context omitted.
For these discount pizza chains, there is usually plenty of coupons floating around - they even accept 'competitor' coupons. You can probably find some if you search for them on the internet. But as old adage goes, you get what you pay for.
> But as old adage goes, you get what you pay for. Fancy cheese on toast?
Not that I don't love pizza. But even with 50% off, those prices...
Earlier quoted context omitted.
> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the…
Why not have the payment processor notify the vendor's server directly? I believe PayPal does this.
The Stripe/Braintree-style flow is nicest in many ways - they post the card details off to the payment processor, who generate a unique retailer-specific token for the card and send that back to the page. The retailer then uses that to process the payment server-side just like they would have done if they had collected the card number, only without the PCI-compliance issues.
Earlier quoted context omitted.
> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the…
Why not have the payment processor notify the vendor's server directly? I believe PayPal does this.
Card details are sent to the processor, a token comes back. You then send the token along with any data relevant to the transaction (which items were purchased, tax zones, coupon codes etc), you then verify on the server that inventory exists etc, and then you send the token (which is only a short-lived represention of the credit card number) and then verify the payment went through, and then you go through the bussines process for delivering your product(s).
Then, and only then do you give back a response saying the order has processed, so the UI can alert the user.
Earlier quoted context omitted.
> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the…
Why not have the payment processor notify the vendor's server directly? I believe PayPal does this.
Otherwise you can change the price and paypal will process your new price, then paypal returns a "yup, they paid" message back to the vendor.
If the vendor only checks they paid and doesn't verify all the other details against the basket you can adjust the price down.
I know this because I actually did this at one of my previous companies, we used to sell SMS bundles for use in our POS (point of sale) product. To demonstrate this vulnerability I lowered the price to a penny and bought our biggest bundle.
Because our test system had the payment side mocked* I had to use the live site.
What I hadn't counted on was the fact that our CEO was CC'd in whenever someone bought a bundle. Thankfully the company wasn't too large, so my boss was able to ask me about it and directly feed back what had happened.
* Technically "just not hooked up" rather than mocked.
My interest is certainly peaked about the 10% off coupons.
Here in the UK there is always a 50% off or better deal for mediums and larges. If you can't find one on the page or from a quick Google ringing the store will get it (only ever had to do this at a friend's in Liverpool)
Earlier quoted context omitted.
> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the…
Why not have the payment processor notify the vendor's server directly? I believe PayPal does this.
Earlier quoted context omitted.
Always 25% off with PapaJohns! Use coupon code 25OFF — it's even valid until December 31, 2017. Unless you mean how they're generated.
Just like pizza tastes better when you made it yourself, it is sweeter when you were able to code your own working coupon generator.