3 ms·
Gather round kids. There was once a day where processing payments online was something that you signed up for with a fax machine, or a merchant processing sales
by reilly3000 7y ago
Gather round kids. There was once a day where processing payments online was something that you signed up for with a fax machine, or a merchant processing salesperson. You might even walk into a bank to get a merchant account, then they would sell you an online gateway for $20-99/month plus transaction fees. If you were lucky, it was Authorize.net, not some 5th party proprietary garbage with a ColdFusion SDK. Not to say Authorize.net was any fun at all to work with, but at least there was a Ruby Gem for it that mostly worked. Payment processing was hard. PCI audits sucked. Millions of full credit cards were stored in MySQL, unencrypted because it was left to the developer to engineer security. REST API? Hah. Hope you know SOAP and XML, and you're using the correct schema version.
Stripe made untold pain and suffering disappear. Congrats to them for getting rewarded for doing so- they have unlocked billions worth of economic value by making that process easier.
PS. Here's a fun little quote from the Authorize.net docs today, 2019-09-19:
The Authorize.Net API, which is not based on REST, offers JSON support through a translation of JSON elements to XML elements. While JSON does not typically require a set order to the elements in an object, XML requires strict ordering. Developers using the Authorize.Net API should force the ordering of elements to match this API Reference.
Do you know how to force a JSON object's elements to be specifically ordered? I don't.
- baddox 7y agoThat’s pretty funny. FYI, object order in JavaScript is a bit complicated, but in practice these days it will maintain the order of key declaration and insertion.
- ci5er 7y agoDsig technologies, such as JSON Web Signature, require "canonicalization" (C14N), in order for the hashes to be consistently generated and then signed and verifiable. Here is one approach: https://tools.ietf.org/id/draft-rundgren-json-canonicalization-scheme-00.html https://tools.ietf.org/id/draft-rundgren-json-canonicalizati...
- bedros 7y agoIt's pretty much because that API is written by someone who hates his/her job
- edoceo 7y agoIs simple. You construct the blob of JSON by hand, just cat some stings together (or implode with "\n"). Then it's real easy to duplicate keys too. (JK, it's stupid). Fun fact tho, the PostgreSQL jsonb data type sorts the keys, and seems to put shorter key names first, then keys with the same length in lexographix order - neat!
- gms 7y agoWhat about Braintree?
- jmathai 7y agoGeez --- dug up 15 year old code that called Authorize.net. It was a DLL and the response looks like it was a comma separated string --- probably predates their XML API. At least the credit card #s were encrypted before storing them to MySql :). https://github.com/jmathai/photos/blob/master/includes/classes/CEcomGateway/CEcomGateway_authorize.php https://github.com/jmathai/photos/blob/master/includes/class... FYI ... I'm not looking for a code review.
- theandrewbailey 7y agoI integrated a storefront with Authorize.net about 6 years ago. The API was dead simple: a URL endpoint with lots of query string parameters. It ended up being ungodly long, but it was much easier than PayPal.
- ChrisArchitect 7y agoha, good. Yes, authorize.net made some things easier, especially around a time when Rails was picking up and a handy ruby gem called activemerchant was available -- going on to power a related/not-related giant, Shopify.