Page MenuHomePhabricator

Adyen Carte Bancaire 3D Secure Headers not being set
Closed, ResolvedPublic


When digging into some of the failures mentioned in I noticed that the required browser info fields e.g. user_agent are not being sent with the createPayment call, in some cases.

Adyen is rejecting a large number of these trxns due to Authentication(3D Secure) being required. We need to work out why the headers are being sent in some calls and not in others.

Event Timeline

Change 816858 had a related patch set uploaded (by Jgleeson; author: Jgleeson):

[mediawiki/extensions/DonationInterface@master] Remove payment submethod check during Adyen 3DSecure

I've tested that patch locally ^^^ and it gets 3D Secure working for the suspected broken Carte Bancaire payments. To test this, you need to add 'FR' to the 'EUR' array under your $wgDonationInterface3DSRules in config-private. you can then comment out lines 308-310 in adyen.js(submethod param on/off) and try a 3D Secure test donation on the French Adyen form locally with and without the patch applied.

When applied, you should get redirected to 3D Secure (Happy path). When not applied, it should go straight to the thank you page and skip 3D Secure(Error path). Test card data here

Change 816864 had a related patch set uploaded (by Ejegg; author: Ejegg):

[mediawiki/extensions/DonationInterface@master] 3DS: make canSet abstract, change Adyen implementation

Just copying here this e-mail to Adyen from @Ejegg, which helped me understand what's going on here, and what exactly we need confirmation from Adyen about:

Here are some more details about why our code was failing to provide the browserInfo in some cases:

We are only sending browserInfo when the card type is in a list of types we know support 3DS. To determine the card type we are looking in the Adyen component's submit argument, under, falling back to component.state.brand if the former is empty. It seems that for some Carte Bancaire cards we get 'visa' as the brand, and for others both of those fields are blank. In the blank case our supported type check fails and we send no browserInfo.

Re-reading the 3DS docs, it seems like we can stop checking that list of card types, and simply always send browserInfo for country/currency combinations that have 3DS enabled on the Adyen console. Am I correct in assuming that there is no problem in always sending browserInfo?

Both of the attached patches look like they'd do the job (haven't smoke tested though). The second one (816864) does seem a bit tidier, though.

Just noting an out-of-scope idea also... $supportedSubMethods feels a bit yaml-config-y? One day should we move it?

Thanks so much!!!

Change 816864 merged by jenkins-bot:

[mediawiki/extensions/DonationInterface@master] 3DS: move card type check to Ingenico subclass

XenoRyet set Final Story Points to 4.

Change 816858 abandoned by Jgleeson:

[mediawiki/extensions/DonationInterface@master] Remove payment submethod check during Adyen 3DSecure