Question

I am adding a "confirm your payment" page to my new ASP.NET MVC 3 project. After validating the input, I then display a confirm page to allow the user to make sure they entered everything correctly. My next problem is how do I "store" the data entered so that I can process the payment after they click "Confirm". Obviously, I don’t want to create hidden fields with the full credit card number.

I am using sessions for our shopping cart, but does that encrypt the data so that a credit card number could not be hacked? What is the recommended approach on this? The searches I have done on Google hasn’t really turned up much.

I am display the information what they entered on the previous page (to confirm the data entry). Properly masking the credit card number of course.

Payment Information

Name on Credit Card: Name

Credit Card Number: XXXX XXXX XXXX 1111

Expiration Date: 10/2011

Card Verification Code: 100

Total to be Charged: $50.86

All numbers on this post are fake of course.

Here is the code I am using so far.

    //
    // POST: /Checkout/AddressAndPayment
    [HttpPost]
    public ActionResult AddressAndPayment(Cart cart, PaymentForm formData)
    {
        if (cart.Items.Count() == 0)
        {
            ModelState.AddModelError("", "Sorry your cart is empty!");
        }

        if (ModelState.IsValid)
        {
            var viewModel = new AddressPaymentViewModel
            {
                FormData = formData,
                Cart = cart
            };

            return View("Confirm", viewModel);
        }
        else
        {
            var viewModel = new AddressPaymentViewModel
            {
                FormData = formData,
                Cart = cart,
                States = States.GetStatesDDL(),
                CreditCardTypes = CreditCartTypes.GetCreditCardTypesDDL()
            };
            return View(viewModel);
        }
    }

    //
    // GET: /Checkout/Confirm
    public ViewResult Confirm()
    {
        return View();
    }

So from there, when I run

    //
    // POST: /Checkout/Confirm
    [HttpPost]
    public ViewResult Confirm(Cart cart, PaymentForm formData)
    {
        return View();
    }

I need to still have the form data to send to the credit card processor.

Is there a better way to do this? What is the "best practice"?

Another method I have seen is to do a "PreAuth" and "PostAuth" with the credit card processor and not store that data period, just an order id.

Answer 1

After researching our options. We decided to do a Pre Authorization transaction. So all we have to store is the Order Id from the processor, then upon confirming the details, we will send a Post Authorization transaction to actually post the payment.