Hidding defined variables in POST

Hi Chris,

Thanks for replying. The reason for the "secrecy" is in the form being used; it will be used to make a payment to a 3rd party vendor gateway and the 'secret' fields consist of various information like terminal ID, terminal password, etc. As you can see, if I used the "hidden" form field approach, anyone viewing the source would have access to this information. The "version" field is just one of the required fields that must be sent to the vendor.

The alternative you mentioned is exactly what I was considering pending a non-feasible possibility using what I described; having the user data (credit card, name, etc) sent (POSTed) to another page where it would be processed in a more secure manner before sending to the 3rd party gateway along with the "secret" info for processing. I just haven't decided how or what language I would approach that with yet [unsure]

I'm not above considering a custom build but, like everyone now-days, do not have a big budget for this project. Can you give me an idea of how complex this might be in terms of time and I'll consult with my customer. I'd be happy to call and give more details.

Thanks!

Eric

Hi,

have you checked if your 3rd party vendor have any instructions or recommendations on how to use their gateway securely?

-aev-

Hi aev,

The 3rd party vendor, nor their IT staff, are not very helpful and simply referred me to another entity that was using the same gateway I guess thinking I could just email them asking for help. The "Integration Guide" they send simply defines the variables required and what type of input is needed from the user and then in a short section states: "...simply construct a message as described in Section 2, and follow the transaction type requirements as outlined in tables in Section 7, and POST it to a <3rd party vendor> URL that is provided to you. The request should be POSTed as ....." Section 2 defines the all fields and section 7 defines the required fields.

Following their instructions would allow the user to see the required information I mentioned in my prior posts; not acceptable. So in a nutshell, no; the did not have any recommendations on how to use their gateway securely.

Thanks for asking.

Eric

Maybe not an option.. could you simply use another 3rd party vendor providing better support?

-aev-

HAHAHAHA! [;)] I wish! Unfortunatly, the customer specified this vendor which I think they have a contract with anyway. Heck, I suggested PayPal which I use and have had no problems. Oh well,...

Eric

Hi Eric,

If you can email me some details to dave@interactivetools.com I can give you some suggestions and options.

Hope that helps!