Method and apparatus for performing transactions over a network using cross-origin communication
A transaction is conducted between a merchant site and a customer's electronic device using a payment processor. The merchant site is associated with a client-side application and a server-side application. The client-side application executes on the customer's electronic device. The client-side application electronically sends payment information retrieved from the customer's electronic device to the payment processor. The client-side application does not send the payment information to the server-side application. The payment processor creates a token from the payment information sent by the client-side application. The token functions as a proxy for the payment information. The payment processor electronically sends the token to the client-side application. The client-side application electronically sends the token to the server-side application for use by the server-side application in conducting the transaction. The payment information can thus be used by the server-side application via the token without the server-side application being exposed to the payment information.
1 . A method for processing a request between a network site and an electronic device of a user, the method comprising:
setting up a secure communication tunnel to a third-party server from a client-side application executed by the electronic device of the user for cross-origin communication between the client-side application and the third party server, the client side-side application served to the electronic device of the user from a server of the network site;
receiving an input from the user as part of a submission from a form displayed to the user by the client-side application to a server-side application of the server of the network site, and wherein authorization information associated with an account of the user accompanies the submission;
in response to the submission, sending user information that includes the authorization information to the third-party server using the secure communication tunnel as part of the cross-origin communication;
creating a token by the third party server through the use of cross-origin communication between the client-side application and the third party server in response to the submission using the authorization information received from the user via the client-side application, wherein at least a portion of the user information accompanies the submission;
receiving, over the secure communication tunnel, the token from the third-party server for completing processing the request; and
sending the token to the server of the network site as part of completing the submission to process the request, wherein the token is sent by the client-side application without user intervention, and the token being used to authorize the use of the account of the user as part of completing the processing of the request.
2 . The method of claim 1 further comprising:
encrypting the at least the portion of the user information; and
comparing the encrypted user information with data stored in a database as part of completing the processing of the request.
3 . The method of claim 1 wherein the submission includes a request for the token, and further comprising:
detecting, by the third-party server, whether the submission includes sensitive information; and
redacting, by the third-party server, the sensitive information from the submission prior to sending the token.
4 . The method of claim 1 further comprising capturing, with an event handler, a submit event in response to the submission, the submission including a callback function to cause return of the token through the secure communication tunnel to be part of the submission to the server-side application.
5 . The method of claim 1 further comprising validating, by the third party server, the user information prior to creating the token.
6 . The method of claim 1 wherein the user information is sent to the third-party server over the secure communication tunnel using an iframe generated by the client side application when setting up the secure communication tunnel.
7 . The method of claim 1 wherein sending the created token to the server of the network site occurs without sending the user information to the server of the network site.
8 . The method of claim 1 wherein the network site has a secret key, and further comprising:
receiving the token and the secret key from the network site as part of completing the processing of the request; and
denying authorization of the request upon determining:
the token has been previously used,
the secret key is not valid, or
the secret key is not associated with the network site.
9 . A network arrangement for processing a request, the network arrangement comprising:
a network site having a network site server with a server-side application;
an electronic device associated with a user and communicably coupled to the network site, wherein the electronic device includes a client-side application for enabling a user to issue the request to the network site,
a third-party server,
wherein the electronic device is configured to:
set up a secure communication tunnel to the third-party server from the client-side application for cross-origin communication between the client-side application and the third party server, the client side-side application served to the electronic device of the user from the network site server;
receive an input from the user as part of a submission from a form displayed to the user by the client-side application to the server-side application of the network site server, and wherein authorization information associated with an account of the user accompanies the submission;
in response to the submission, send user information that includes the authorization information to the third-party server using the secure communication tunnel as part of the cross-origin communication;
receive, over the secure communication tunnel, a token from the third-party server for completing processing the request; and
send the token to the network site server as part of completing the submission to process the request, wherein the token is sent by the client-side application without user intervention, and the token being used to authorize the use of the account of the user as part of completing the processing of the request.
10 . The network arrangement of claim 9 further comprising:
encrypting the at least the portion of the user information; and
comparing the encrypted user information with data stored in a database as part of completing the processing of the request.
11 . The network arrangement of claim 9 further comprising capturing, with an event handler, a submit event in response to the submission, the submission including a callback function to cause return of the token through the secure communication tunnel to be part of the submission to the server-side application.
12 . The network arrangement of claim 9 further comprising validating, by the third party server, the user information prior to creating the token.
13 . The network arrangement of claim 9 wherein the user information is sent to the third-party server over the secure communication tunnel using an iframe generated by the client side application when setting up the secure communication tunnel.
14 . An article of manufacture having one or more non-transitory computer readable media storing instructions which, when executed by an electronic device of a user, a network site server and a third-party server of a network arrangement, cause the network arrangement to perform a method for processing a request of the user without requiring a preexisting relationship between the third-party server and the user while preventing access by the network arrangement to certain sensitive information of the user used to complete the processing of the request, the method comprising:
setting up a secure communication tunnel to a third-party server from a client-side application executed by the electronic device of the user for cross-origin communication between the client-side application and the third party server, the client side-side application served to the electronic device of the user from a server of the network site;
receiving an input from the user as part of a submission from a form displayed to the user by the client-side application to a server-side application of the server of the network site, and wherein authorization information associated with an account of the user accompanies the submission;
in response to the submission, sending user information that includes the authorization information to the third-party server using the secure communication tunnel as part of the cross-origin communication;
creating a token by the third party server through use of cross-origin communication between the client-side application and the third party server in response to the submission using the authorization information received from the user via the client-side application, wherein at least a portion of the user information accompanies the submission;
receiving, over the secure communication tunnel, the token from the third-party server for completing processing the request; and
sending the token to the server of the network site as part of completing the submission to process the request, wherein the token is sent by the client-side application without user intervention, and the token being used to authorize the use of the account of the user as part of completing the processing of the request.
15 . The article of manufacture of claim 14 wherein the submission includes a request for the token, and further wherein the method includes:
detecting, by the third-party server, whether the submission includes sensitive information; and
redacting, by the third-party server, the sensitive information from the submission prior to sending the token.
16 . The article of manufacture of claim 14 wherein the method further comprises:
receiving the token from the network site as part of completing the processing of the request; and
in response to determining that the token has been previously used, denying authorization of the request.